RHSA-2026:99741: Important: mysql:8.4 security update
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.Security Fix(es): mysql: mysql: system takeover via mysqldump component (CVE-2026-101797) mysql: mysql: unauthorized server takeover (CVE-2026-101772) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101724) mysql: mysql: Denial of Service via client programs (CVE-2026-101754) mysql: mysql: System takeover via client programs (CVE-2026-101770) mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101732) mysql: mysql: Denial of Service via server optimizer flaw (CVE-2026-101623) mysql: mysql: Denial of Service via the Replication component (CVE-2026-101727) mysql: mysql: Denial of Service via the audit component (CVE-2026-101748) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101747) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101617) mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101607) mysql: mysql: Complete server takeover via replication component (CVE-2026-101796) mysql: mysql: Denial of Service (CVE-2026-101778) mysql: MySQL Server: Denial of service in the Server Optimizer (CVE-2026-101731) mysql: mysql: Denial of Service in Group Replication plugin (CVE-2026-101776) mysql: mysql: Denial of service in InnoDB (CVE-2026-101609) mysql: mysql: Denial of service in InnoDB (CVE-2026-101760) mysql: mysql: unauthorized data modification via replication component (CVE-2026-101775) mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101610) mysql: mysql: Denial of Service via the C API (CVE-2026-101726) mysql: mysql: unauthorized data modification via XML component (CVE-2026-101803) mysql: mysql: Denial of Service in Group Replication (CVE-2026-101751) mysql: mysql: Denial of Service via Server Optimizer flaw (CVE-2026-101787) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101619) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101622) mysql: mysql: Denial of Service via the Optimizer component (CVE-2026-101789) mysql: mysql: Denial of service in replication component (CVE-2026-101766) mysql: mysql: Denial of Service in Clone Plugin (CVE-2026-101750) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101618) mysql: mysql: Denial of Service via the Server Replication component (CVE-2026-101729) mysql: MySQL: Denial of Service via the Group Replication plugin (CVE-2026-101773) mysql: mysql: Denial of Service via security encryption component (CVE-2026-101762) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101611) mysql: mysql: unauthorized data access via improper privilege controls (CVE-2026-101800) mysql: mysql: Partial Denial of Service via Telemetry component (CVE-2026-101779) mysql: mysql: Denial of Service via Group Replication GCS (CVE-2026-101799) mysql: mysql: Denial of service in InnoDB (CVE-2026-101615) mysql: mysql: Denial of Service via the Server Parser (CVE-2026-101802) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101627) mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101730) mysql: mysql: Denial of Service via JSON component (CVE-2026-101733) mysql: mysql: Denial of Service via the C API component (CVE-2026-101725) mysql: mysql: Denial of Service via security encryption component (CVE-2026-101761) mysql: mysql: Denial of Service in InnoDB (CVE-2026-101621) mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101608) mysql: mysql: Denial of Service in Server Components Services (CVE-2026-101721) mysql: mysql: Denial of service via DDL component (CVE-2026-101613) mysql: mysql: Denial of Service via multiple protocols (CVE-2026-101679) mysql: mysql: Denial of Service via X Plugin (CVE-2026-101780) mysql: mysql: Denial of Service via Server Components Services (CVE-2026-101788) mysql: mysql: Denial of Service via XML component flaw (CVE-2026-101794) mysql: mysql: Denial of Service in Pluggable Auth (CVE-2026-101728) mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101801) mysql: MySQL: Denial of Service via JSON component (CVE-2026-101616) mysql: mysql: complete service takeover via network access (CVE-2026-101771) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101612) mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101614) mysql: mysql: Complete service compromise by a local privileged attacker (CVE-2026-101795) mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781) mysql: mysql: Denial of Service in the server optimizer (CVE-2026-101798) mysql: mysql: Denial of service via InnoDB storage engine (CVE-2026-101624) mysql: mysql: Denial of service via Pluggable Authentication component (CVE-2026-101774) mysql: MySQL: Unauthorized data modification in JSON component (CVE-2026-101785) mysql: mysql: Denial of service in query optimizer (CVE-2026-101784) rapidjson: rapidjson: Denial of Service via out-of-bounds read in regex parser (CVE-2026-116620) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mecabto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4 - Upgrade
Upgrade
redhat/mecab-ipadicto a version that resolves this vulnerability.Fixed in 2.7.0.20070801-24.module+el9.9.0+24089+64aac046 - Upgrade
Upgrade
redhat/mysqlto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/rapidjsonto a version that resolves this vulnerability.Fixed in 1.1.0-20.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-commonto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-errmsgto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-test-datato a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/rapidjson-docto a version that resolves this vulnerability.Fixed in 1.1.0-20.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mecab-debuginfoto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4 - Upgrade
Upgrade
redhat/mecab-debugsourceto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4 - Upgrade
Upgrade
redhat/mecab-develto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4 - Upgrade
Upgrade
redhat/mysql-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-debugsourceto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-develto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-devel-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-libsto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-libs-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-serverto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-server-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-testto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mysql-test-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/rapidjson-develto a version that resolves this vulnerability.Fixed in 1.1.0-20.module+el9.9.0+25300+c0fc77bc - Upgrade
Upgrade
redhat/mecabto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4.aa - Upgrade
Upgrade
redhat/mecab-debuginfoto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4.aa - Upgrade
Upgrade
redhat/mecab-debugsourceto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4.aa - Upgrade
Upgrade
redhat/mecab-develto a version that resolves this vulnerability.Fixed in 0.996-3.module+el9.9.0+24089+64aac046.4.aa - Upgrade
Upgrade
redhat/mecab-ipadicto a version that resolves this vulnerability.Fixed in 2.7.0.20070801-24.module+el9.9.0+24089+64aac046.aa - Upgrade
Upgrade
redhat/mysqlto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-debugsourceto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-develto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-devel-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-libsto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-libs-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-serverto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-server-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-testto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/mysql-test-debuginfoto a version that resolves this vulnerability.Fixed in 8.4.13-1.module+el9.9.0+25300+c0fc77bc.aa - Upgrade
Upgrade
redhat/rapidjson-develto a version that resolves this vulnerability.Fixed in 1.1.0-20.module+el9.9.0+25300+c0fc77bc.aa
Event History
Frequently Asked Questions
Are systems using only MySQL client tools relevant to this update?
Yes. The listed fixes include vulnerabilities affecting MySQL client programs and the mysqldump component, in addition to MySQL server components.
Does this update address risks beyond service disruption?
Yes. The listed fixes include system or server takeover issues involving mysqldump, client programs, and replication, as well as multiple denial-of-service issues.
Can the provided advisory data determine whether a specific configuration is exploitable?
No. The data identifies affected components and CVEs, but does not provide exploit prerequisites, authentication requirements, network exposure conditions, or default-configuration details.