[debian-mysql] Bug#1134614: mysql-8.0: CVE-2026-34267 CVE-2026-35236 CVE-2026-35237 CVE-2026-35238 CVE-2026-35239 CVE-2026-35240 CVE-2026-34270 CVE-2026-34271 CVE-2026-34276 CVE-2026-34278 CVE-2026-34293 CVE-2026-34303 CVE-2026-34304 CVE-2026-34308 CVE-2026-34317 CVE-2026-34318 CVE-2026-34319 CVE-2026-22004 CVE-2026-22005 CVE-2026-22009 CVE-2026-22015 CVE-2026-22017 CVE-2026-21998 CVE-2026-22001 CVE-2026-22002
Moritz Mühlenhoff
jmm at inutil.org
Wed Apr 22 10:45:25 BST 2026
Source: mysql-8.0
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for mysql-8.0.
CVE-2026-34267[0]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows
| high privileged attacker with network access via multiple protocols
| to compromise MySQL Server. Successful attacks of this
| vulnerability can result in unauthorized ability to cause a hang or
| frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1
| Base Score 4.9 (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-35236[1]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: InnoDB). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows high privileged attacker with network access
| via multiple protocols to compromise MySQL Server. Successful
| attacks of this vulnerability can result in unauthorized ability to
| cause a hang or frequently repeatable crash (complete DOS) of MySQL
| Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-35237[2]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: InnoDB). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows high privileged attacker with network access
| via multiple protocols to compromise MySQL Server. Successful
| attacks of this vulnerability can result in unauthorized ability to
| cause a hang or frequently repeatable crash (complete DOS) of MySQL
| Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-35238[3]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: InnoDB). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows high privileged attacker with network access
| via multiple protocols to compromise MySQL Server. Successful
| attacks of this vulnerability can result in unauthorized ability to
| cause a hang or frequently repeatable crash (complete DOS) of MySQL
| Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-35239[4]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: DML). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows high privileged attacker with network access
| via multiple protocols to compromise MySQL Server. Successful
| attacks of this vulnerability can result in unauthorized ability to
| cause a hang or frequently repeatable crash (complete DOS) of MySQL
| Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-35240[5]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows high privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34270[6]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Group Replication Plugin). Supported versions
| that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0.
| Easily exploitable vulnerability allows low privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34271[7]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Group Replication Plugin). Supported versions
| that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0.
| Easily exploitable vulnerability allows low privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34276[8]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Group Replication Plugin). Supported versions
| that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0.
| Easily exploitable vulnerability allows low privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34278[9]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows
| high privileged attacker with network access via multiple protocols
| to compromise MySQL Server. Successful attacks of this
| vulnerability can result in unauthorized ability to cause a hang or
| frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1
| Base Score 4.9 (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34293[10]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: DML). Supported versions that are affected are
| 8.0.0-8.0.45. Easily exploitable vulnerability allows high
| privileged attacker with network access via multiple protocols to
| compromise MySQL Server. Successful attacks of this vulnerability
| can result in unauthorized ability to cause a hang or frequently
| repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score
| 4.9 (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34303[11]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows low privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34304[12]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: InnoDB). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows high privileged attacker with network access
| via multiple protocols to compromise MySQL Server. Successful
| attacks of this vulnerability can result in unauthorized ability to
| cause a hang or frequently repeatable crash (complete DOS) of MySQL
| Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34308[13]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: JSON). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows low privileged attacker with network access via
| multiple protocols to compromise MySQL Server. Successful attacks
| of this vulnerability can result in unauthorized ability to cause a
| hang or frequently repeatable crash (complete DOS) of MySQL Server.
| CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-34317[14]:
| Vulnerability in the MySQL Shell product of Oracle MySQL (component:
| Shell: Core Client). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows low privileged attacker with logon to the
| infrastructure where MySQL Shell executes to compromise MySQL Shell.
| Successful attacks require human interaction from a person other
| than the attacker. Successful attacks of this vulnerability can
| result in unauthorized ability to cause a hang or frequently
| repeatable crash (complete DOS) of MySQL Shell. CVSS 3.1 Base Score
| 5.0 (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).
CVE-2026-34318[15]:
| Vulnerability in the MySQL Shell product of Oracle MySQL (component:
| Shell: Core Client). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Difficult to exploit
| vulnerability allows high privileged attacker with network access
| via multiple protocols to compromise MySQL Shell. While the
| vulnerability is in MySQL Shell, attacks may significantly impact
| additional products (scope change). Successful attacks of this
| vulnerability can result in unauthorized access to critical data or
| complete access to all MySQL Shell accessible data. CVSS 3.1 Base
| Score 5.8 (Confidentiality impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).
CVE-2026-34319[16]:
| Vulnerability in the MySQL Shell product of Oracle MySQL (component:
| Shell: Core Client). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows low privileged attacker with logon to the
| infrastructure where MySQL Shell executes to compromise MySQL Shell.
| Successful attacks require human interaction from a person other
| than the attacker. Successful attacks of this vulnerability can
| result in unauthorized ability to cause a hang or frequently
| repeatable crash (complete DOS) of MySQL Shell. CVSS 3.1 Base Score
| 5.0 (Availability impacts). CVSS Vector:
| (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).
CVE-2026-22004[17]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: InnoDB). Supported versions that are affected are
| 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable
| vulnerability allows high privileged attacker with network access
| via multiple protocols to compromise MySQL Server. Successful
| attacks of this vulnerability can result in unauthorized ability to
| cause a hang or frequently repeatable crash (complete DOS) of MySQL
| Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-22005[18]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows high privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-22009[19]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows low privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-22015[20]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Information Schema). Supported versions that
| are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows low privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| read access to a subset of MySQL Server accessible data. CVSS 3.1
| Base Score 4.3 (Confidentiality impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-22017[21]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows low privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-21998[22]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows high privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-22001[23]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Information Schema). Supported versions that
| are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows high privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| read access to a subset of MySQL Server accessible data. CVSS 3.1
| Base Score 2.7 (Confidentiality impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-22002[24]:
| Vulnerability in the MySQL Server product of Oracle MySQL
| (component: Server: Optimizer). Supported versions that are
| affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily
| exploitable vulnerability allows high privileged attacker with
| network access via multiple protocols to compromise MySQL Server.
| Successful attacks of this vulnerability can result in unauthorized
| ability to cause a hang or frequently repeatable crash (complete
| DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability
| impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-34267
https://www.cve.org/CVERecord?id=CVE-2026-34267
[1] https://security-tracker.debian.org/tracker/CVE-2026-35236
https://www.cve.org/CVERecord?id=CVE-2026-35236
[2] https://security-tracker.debian.org/tracker/CVE-2026-35237
https://www.cve.org/CVERecord?id=CVE-2026-35237
[3] https://security-tracker.debian.org/tracker/CVE-2026-35238
https://www.cve.org/CVERecord?id=CVE-2026-35238
[4] https://security-tracker.debian.org/tracker/CVE-2026-35239
https://www.cve.org/CVERecord?id=CVE-2026-35239
[5] https://security-tracker.debian.org/tracker/CVE-2026-35240
https://www.cve.org/CVERecord?id=CVE-2026-35240
[6] https://security-tracker.debian.org/tracker/CVE-2026-34270
https://www.cve.org/CVERecord?id=CVE-2026-34270
[7] https://security-tracker.debian.org/tracker/CVE-2026-34271
https://www.cve.org/CVERecord?id=CVE-2026-34271
[8] https://security-tracker.debian.org/tracker/CVE-2026-34276
https://www.cve.org/CVERecord?id=CVE-2026-34276
[9] https://security-tracker.debian.org/tracker/CVE-2026-34278
https://www.cve.org/CVERecord?id=CVE-2026-34278
[10] https://security-tracker.debian.org/tracker/CVE-2026-34293
https://www.cve.org/CVERecord?id=CVE-2026-34293
[11] https://security-tracker.debian.org/tracker/CVE-2026-34303
https://www.cve.org/CVERecord?id=CVE-2026-34303
[12] https://security-tracker.debian.org/tracker/CVE-2026-34304
https://www.cve.org/CVERecord?id=CVE-2026-34304
[13] https://security-tracker.debian.org/tracker/CVE-2026-34308
https://www.cve.org/CVERecord?id=CVE-2026-34308
[14] https://security-tracker.debian.org/tracker/CVE-2026-34317
https://www.cve.org/CVERecord?id=CVE-2026-34317
[15] https://security-tracker.debian.org/tracker/CVE-2026-34318
https://www.cve.org/CVERecord?id=CVE-2026-34318
[16] https://security-tracker.debian.org/tracker/CVE-2026-34319
https://www.cve.org/CVERecord?id=CVE-2026-34319
[17] https://security-tracker.debian.org/tracker/CVE-2026-22004
https://www.cve.org/CVERecord?id=CVE-2026-22004
[18] https://security-tracker.debian.org/tracker/CVE-2026-22005
https://www.cve.org/CVERecord?id=CVE-2026-22005
[19] https://security-tracker.debian.org/tracker/CVE-2026-22009
https://www.cve.org/CVERecord?id=CVE-2026-22009
[20] https://security-tracker.debian.org/tracker/CVE-2026-22015
https://www.cve.org/CVERecord?id=CVE-2026-22015
[21] https://security-tracker.debian.org/tracker/CVE-2026-22017
https://www.cve.org/CVERecord?id=CVE-2026-22017
[22] https://security-tracker.debian.org/tracker/CVE-2026-21998
https://www.cve.org/CVERecord?id=CVE-2026-21998
[23] https://security-tracker.debian.org/tracker/CVE-2026-22001
https://www.cve.org/CVERecord?id=CVE-2026-22001
[24] https://security-tracker.debian.org/tracker/CVE-2026-22002
https://www.cve.org/CVERecord?id=CVE-2026-22002
Please adjust the affected versions in the BTS as needed.
More information about the pkg-mysql-maint
mailing list