Security Update for MySQL 8.4: Moderate Vulnerabilities Addressed
Summary
ALSA-2026:4162: Moderate: mysql8.4 security update. Affects mysql8.4 versions < 8.4.8-1.el10_1. Fixed in 8.4.8-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MySQL is a widely-used multi-user, multi-threaded SQL database server that operates on a client/server model. It consists of a server daemon (mysqld) and various client programs and libraries. MySQL is known for its reliability, performance, and ease of use, making it a popular choice for web applications and data management. However, recent vulnerabilities have been identified that could potentially compromise the security of MySQL installations, particularly in version 8.4.
Vulnerability Detail
The vulnerabilities in MySQL 8.4 stem from unspecified issues in the optimizer, InnoDB, DDL, and thread pooling components. These vulnerabilities were disclosed in the January 2026 Critical Patch Update (CPU) and could allow unauthorized access or manipulation of data, leading to potential data breaches or service disruptions. The specific CVEs associated with these vulnerabilities include CVE-2026-21936, CVE-2026-21937, CVE-2026-21941, CVE-2026-21948, CVE-2026-21964, and CVE-2026-21968.
How To Fix
Minimum fixed version
8.4.8-1.el10_1
This is the first release that contains the fix.
sudo dnf update mysql8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the MySQL server by configuring firewall rules to limit connections to trusted IP addresses only. This can help mitigate the risk of exploitation until the update is applied.
Conclusion
The recent security update for MySQL 8.4 addresses several moderate vulnerabilities that could impact the integrity and security of database operations. It is crucial for users to update to the patched version 8.4.8-1.el10_1 to safeguard their systems against potential threats.
See every vulnerability recorded for mysql8.4 →
FAQ
The update addresses multiple unspecified vulnerabilities in the optimizer, InnoDB, DDL, and thread pooling components of MySQL 8.4.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement firewall rules to restrict access to the MySQL server to trusted IP addresses as a temporary workaround.
More information can be found on the CVE pages associated with the vulnerabilities, such as CVE-2026-21936, CVE-2026-21937, and others.
Continuing to use MySQL 8.4 without applying the update poses security risks, as the vulnerabilities could be exploited by attackers.
Related vulnerabilities
Recent vulnerabilities recorded for mysql8.4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
