MySQL 8.4 -- Multiple vulnerabilities

2026-08-05 · CVE-2026-46936, CVE-2026-47012, CVE-2026-47023, CVE-2026-47052, CVE-2026-47064, CVE-2026-60145, CVE-2026-60163, CVE-2026-60177, CVE-2026-60178, CVE-2026-60182, CVE-2026-60183, CVE-2026-60184, CVE-2026-60185, CVE-2026-60186, CVE-2026-60187, CVE-2026-60188, CVE-2026-60189, CVE-2026-60190, CVE-2026-60191, CVE-2026-60314, CVE-2026-60315, CVE-2026-60316, CVE-2026-60331, CVE-2026-60332, CVE-2026-60585, CVE-2026-60725, CVE-2026-60747, CVE-2026-61081, CVE-2026-61094, CVE-2026-61096, CVE-2026-61109 · VuXML entry

The Oracle Critical Patch Update of July 2026 addresses 54 issues in Oracle MySQL, 31 of which apply to the MySQL 8.4 series and to the MySQL Router shipped with these ports. The affected server components are Optimizer, Replication, Group Replication (plugin and GCS), X Plugin, Clone Plugin, InnoDB, JSON, DDL, Performance Schema and Pluggable Authentication. Most of the issues require an authenticated account, in …

Affected versions

• mysql84-client < 8.4.11
• mysql84-server < 8.4.11

By system

0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.