{"id":"RLSA-2026:99741","summary":"Important: mysql:8.4 security update","details":"MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.\n\nSecurity Fix(es):\n\n* mysql: mysql: system takeover via mysqldump component (CVE-2026-101797)\n\n* mysql: mysql: unauthorized server takeover (CVE-2026-101772)\n\n* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101724)\n\n* mysql: mysql: Denial of Service via client programs (CVE-2026-101754)\n\n* mysql: mysql: System takeover via client programs (CVE-2026-101770)\n\n* mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101732)\n\n* mysql: mysql: Denial of Service via server optimizer flaw (CVE-2026-101623)\n\n* mysql: mysql: Denial of Service via the Replication component (CVE-2026-101727)\n\n* mysql: mysql: Denial of Service via the audit component (CVE-2026-101748)\n\n* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101747)\n\n* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101617)\n\n* mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101607)\n\n* mysql: mysql: Complete server takeover via replication component (CVE-2026-101796)\n\n* mysql: mysql: Denial of Service (CVE-2026-101778)\n\n* mysql: MySQL Server: Denial of service in the Server Optimizer (CVE-2026-101731)\n\n* mysql: mysql: Denial of Service in Group Replication plugin (CVE-2026-101776)\n\n* mysql: mysql: Denial of service in InnoDB (CVE-2026-101609)\n\n* mysql: mysql: Denial of service in InnoDB (CVE-2026-101760)\n\n* mysql: mysql: unauthorized data modification via replication component (CVE-2026-101775)\n\n* mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101610)\n\n* mysql: mysql: Denial of Service via the C API (CVE-2026-101726)\n\n* mysql: mysql: unauthorized data modification via XML component (CVE-2026-101803)\n\n* mysql: mysql: Denial of Service in Group Replication (CVE-2026-101751)\n\n* mysql: mysql: Denial of Service via Server Optimizer flaw (CVE-2026-101787)\n\n* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101619)\n\n* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101622)\n\n* mysql: mysql: Denial of Service via the Optimizer component (CVE-2026-101789)\n\n* mysql: mysql: Denial of service in replication component (CVE-2026-101766)\n\n* mysql: mysql: Denial of Service in Clone Plugin (CVE-2026-101750)\n\n* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101618)\n\n* mysql: mysql: Denial of Service via the Server Replication component (CVE-2026-101729)\n\n* mysql: MySQL: Denial of Service via the Group Replication plugin (CVE-2026-101773)\n\n* mysql: mysql: Denial of Service via security encryption component (CVE-2026-101762)\n\n* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101611)\n\n* mysql: mysql: unauthorized data access via improper privilege controls (CVE-2026-101800)\n\n* mysql: mysql: Partial Denial of Service via Telemetry component (CVE-2026-101779)\n\n* mysql: mysql: Denial of Service via Group Replication GCS (CVE-2026-101799)\n\n* mysql: mysql: Denial of service in InnoDB (CVE-2026-101615)\n\n* mysql: mysql: Denial of Service via the Server Parser (CVE-2026-101802)\n\n* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101627)\n\n* mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101730)\n\n* mysql: mysql: Denial of Service via JSON component (CVE-2026-101733)\n\n* mysql: mysql: Denial of Service via the C API component (CVE-2026-101725)\n\n* mysql: mysql: Denial of Service via security encryption component (CVE-2026-101761)\n\n* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101621)\n\n* mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101608)\n\n* mysql: mysql: Denial of Service in Server Components Services (CVE-2026-101721)\n\n* mysql: mysql: Denial of service via DDL component (CVE-2026-101613)\n\n* mysql: mysql: Denial of Service via multiple protocols (CVE-2026-101679)\n\n* mysql: mysql: Denial of Service via X Plugin (CVE-2026-101780)\n\n* mysql: mysql: Denial of Service via Server Components Services (CVE-2026-101788)\n\n* mysql: mysql: Denial of Service via XML component flaw (CVE-2026-101794)\n\n* mysql: mysql: Denial of Service in Pluggable Auth (CVE-2026-101728)\n\n* mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101801)\n\n* mysql: MySQL: Denial of Service via JSON component (CVE-2026-101616)\n\n* mysql: mysql: complete service takeover via network access (CVE-2026-101771)\n\n* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101612)\n\n* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101614)\n\n* mysql: mysql: Complete service compromise by a local privileged attacker (CVE-2026-101795)\n\n* mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781)\n\n* mysql: mysql: Denial of Service in the server optimizer (CVE-2026-101798)\n\n* mysql: mysql: Denial of service via InnoDB storage engine (CVE-2026-101624)\n\n* mysql: mysql: Denial of service via Pluggable Authentication component (CVE-2026-101774)\n\n* mysql: MySQL: Unauthorized data modification in JSON component (CVE-2026-101785)\n\n* mysql: mysql: Denial of service in query optimizer (CVE-2026-101784)\n\n* rapidjson: rapidjson: Denial of Service via out-of-bounds read in regex parser (CVE-2026-116620)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","modified":"2026-11-13T03:30:02.613352723Z","published":"2026-11-13T02:54:30.999268Z","upstream":["CVE-2026-101607","CVE-2026-101608","CVE-2026-101609","CVE-2026-101610","CVE-2026-101611","CVE-2026-101612","CVE-2026-101613","CVE-2026-101614","CVE-2026-101615","CVE-2026-101616","CVE-2026-101617","CVE-2026-101618","CVE-2026-101619","CVE-2026-101621","CVE-2026-101622","CVE-2026-101623","CVE-2026-101624","CVE-2026-101627","CVE-2026-101679","CVE-2026-101721","CVE-2026-101724","CVE-2026-101725","CVE-2026-101726","CVE-2026-101727","CVE-2026-101728","CVE-2026-101729","CVE-2026-101730","CVE-2026-101731","CVE-2026-101732","CVE-2026-101733","CVE-2026-101747","CVE-2026-101748","CVE-2026-101750","CVE-2026-101751","CVE-2026-101754","CVE-2026-101760","CVE-2026-101761","CVE-2026-101762","CVE-2026-101766","CVE-2026-101770","CVE-2026-101771","CVE-2026-101772","CVE-2026-101773","CVE-2026-101774","CVE-2026-101775","CVE-2026-101776","CVE-2026-101778","CVE-2026-101779","CVE-2026-101780","CVE-2026-101781","CVE-2026-101784","CVE-2026-101785","CVE-2026-101787","CVE-2026-101788","CVE-2026-101789","CVE-2026-101794","CVE-2026-101795","CVE-2026-101796","CVE-2026-101797","CVE-2026-101798","CVE-2026-101799","CVE-2026-101800","CVE-2026-101801","CVE-2026-101802","CVE-2026-101803","CVE-2026-116620"],"database_specific":{"source_advisory":"RHSA-2026:99741","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/"},"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:99741"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556715"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556754"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556772"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556828"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556853"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556857"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556916"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556952"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557019"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557059"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557066"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557095"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557109"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557111"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557116"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557128"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557143"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557158"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557179"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557183"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557186"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557208"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557217"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557240"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557253"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557263"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557265"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557285"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557297"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557323"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557332"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557345"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557362"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557363"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557388"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557393"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557409"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557469"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557470"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557516"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557518"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557530"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557542"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557556"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557573"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557589"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557606"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557607"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557637"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557717"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557736"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557749"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557786"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557796"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557799"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557822"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557830"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557834"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557851"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557856"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557873"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557876"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557877"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557902"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557945"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561515"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:99741"}],"affected":[{"package":{"name":"mecab","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/mecab?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.996-3.module+el9.8.0+40162+a76274f1.4"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99741.json"}},{"package":{"name":"mecab","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/mecab?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.996-3.module+el9.8.0+40205+77f4da59.4"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99741.json"}},{"package":{"name":"mecab-ipadic","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/mecab-ipadic?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0.20070801-24.module+el9.8.0+40162+a76274f1"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99741.json"}},{"package":{"name":"mecab-ipadic","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/mecab-ipadic?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0.20070801-24.module+el9.8.0+40205+77f4da59"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99741.json"}},{"package":{"name":"perl-DBD-MySQL","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/perl-DBD-MySQL?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.053-3.module+el9.8.0+40205+77f4da59"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99741.json"}},{"package":{"name":"perl-DBD-MySQL","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/perl-DBD-MySQL?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.053-3.module+el9.8.0+40162+a76274f1"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99741.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}