Issued at: 2026-11-13
Updated at: 2026-11-13
Advisory content derived from Red Hat RHSA-2026:99741, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: mysql:8.4 security update
Description
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.
Security Fix(es):
* mysql: mysql: system takeover via mysqldump component (CVE-2026-101797)
* mysql: mysql: unauthorized server takeover (CVE-2026-101772)
* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101724)
* mysql: mysql: Denial of Service via client programs (CVE-2026-101754)
* mysql: mysql: System takeover via client programs (CVE-2026-101770)
* mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101732)
* mysql: mysql: Denial of Service via server optimizer flaw (CVE-2026-101623)
* mysql: mysql: Denial of Service via the Replication component (CVE-2026-101727)
* mysql: mysql: Denial of Service via the audit component (CVE-2026-101748)
* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101747)
* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101617)
* mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101607)
* mysql: mysql: Complete server takeover via replication component (CVE-2026-101796)
* mysql: mysql: Denial of Service (CVE-2026-101778)
* mysql: MySQL Server: Denial of service in the Server Optimizer (CVE-2026-101731)
* mysql: mysql: Denial of Service in Group Replication plugin (CVE-2026-101776)
* mysql: mysql: Denial of service in InnoDB (CVE-2026-101609)
* mysql: mysql: Denial of service in InnoDB (CVE-2026-101760)
* mysql: mysql: unauthorized data modification via replication component (CVE-2026-101775)
* mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101610)
* mysql: mysql: Denial of Service via the C API (CVE-2026-101726)
* mysql: mysql: unauthorized data modification via XML component (CVE-2026-101803)
* mysql: mysql: Denial of Service in Group Replication (CVE-2026-101751)
* mysql: mysql: Denial of Service via Server Optimizer flaw (CVE-2026-101787)
* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101619)
* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101622)
* mysql: mysql: Denial of Service via the Optimizer component (CVE-2026-101789)
* mysql: mysql: Denial of service in replication component (CVE-2026-101766)
* mysql: mysql: Denial of Service in Clone Plugin (CVE-2026-101750)
* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101618)
* mysql: mysql: Denial of Service via the Server Replication component (CVE-2026-101729)
* mysql: MySQL: Denial of Service via the Group Replication plugin (CVE-2026-101773)
* mysql: mysql: Denial of Service via security encryption component (CVE-2026-101762)
* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101611)
* mysql: mysql: unauthorized data access via improper privilege controls (CVE-2026-101800)
* mysql: mysql: Partial Denial of Service via Telemetry component (CVE-2026-101779)
* mysql: mysql: Denial of Service via Group Replication GCS (CVE-2026-101799)
* mysql: mysql: Denial of service in InnoDB (CVE-2026-101615)
* mysql: mysql: Denial of Service via the Server Parser (CVE-2026-101802)
* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101627)
* mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101730)
* mysql: mysql: Denial of Service via JSON component (CVE-2026-101733)
* mysql: mysql: Denial of Service via the C API component (CVE-2026-101725)
* mysql: mysql: Denial of Service via security encryption component (CVE-2026-101761)
* mysql: mysql: Denial of Service in InnoDB (CVE-2026-101621)
* mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101608)
* mysql: mysql: Denial of Service in Server Components Services (CVE-2026-101721)
* mysql: mysql: Denial of service via DDL component (CVE-2026-101613)
* mysql: mysql: Denial of Service via multiple protocols (CVE-2026-101679)
* mysql: mysql: Denial of Service via X Plugin (CVE-2026-101780)
* mysql: mysql: Denial of Service via Server Components Services (CVE-2026-101788)
* mysql: mysql: Denial of Service via XML component flaw (CVE-2026-101794)
* mysql: mysql: Denial of Service in Pluggable Auth (CVE-2026-101728)
* mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101801)
* mysql: MySQL: Denial of Service via JSON component (CVE-2026-101616)
* mysql: mysql: complete service takeover via network access (CVE-2026-101771)
* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101612)
* mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101614)
* mysql: mysql: Complete service compromise by a local privileged attacker (CVE-2026-101795)
* mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781)
* mysql: mysql: Denial of Service in the server optimizer (CVE-2026-101798)
* mysql: mysql: Denial of service via InnoDB storage engine (CVE-2026-101624)
* mysql: mysql: Denial of service via Pluggable Authentication component (CVE-2026-101774)
* mysql: MySQL: Unauthorized data modification in JSON component (CVE-2026-101785)
* mysql: mysql: Denial of service in query optimizer (CVE-2026-101784)
* rapidjson: rapidjson: Denial of Service via out-of-bounds read in regex parser (CVE-2026-116620)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.