Базы данных: уязвимости стека · Страница 15

CVE-2026-21950

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVE-2026-21949

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVE-2026-21948

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.0.45-0ubuntu0.22.04.1
• Обновитесь до 8.0.45-0ubuntu0.24.04.1
• Обновитесь до 8.4.8-0ubuntu0.25.10.1
• Обновитесь до 8.4.8-0ubuntu1

CVE-2026-21941

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.0.45-0ubuntu0.22.04.1
• Обновитесь до 8.0.45-0ubuntu0.24.04.1
• Обновитесь до 8.4.8-0ubuntu0.25.10.1
• Обновитесь до 8.4.8-0ubuntu1

CVE-2026-21937

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.0.45-0ubuntu0.22.04.1
• Обновитесь до 8.0.45-0ubuntu0.24.04.1
• Обновитесь до 8.4.8-0ubuntu0.25.10.1
• Обновитесь до 8.4.8-0ubuntu1

CVE-2026-21936

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.0.45-0ubuntu0.22.04.1
• Обновитесь до 8.0.45-0ubuntu0.24.04.1
• Обновитесь до 8.4.8-0ubuntu0.25.10.1
• Обновитесь до 8.4.8-0ubuntu1

CVE-2026-21929

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000.

• Обновитесь до 11.8.6-0+deb13u1
• Обновитесь до 1:10.11.18-0+deb12u1
• Обновитесь до 1:11.8.5-1

PostgreSQL libpq undersizes allocations, via integer wraparound

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

• Обновитесь до 13.23
• Обновитесь до 14.20
• Обновитесь до 14.20-0ubuntu0.22.04.1
• Обновитесь до 15.15
• Обновитесь до 15.15-0+deb12u1
• Обновитесь до 16.11
• Обновитесь до 16.11-0ubuntu0.24.04.1
• Обновитесь до 17.7
• Обновитесь до 17.7-0+deb13u1
• Обновитесь до 17.7-0ubuntu0.25.10.1
• Обновитесь до 18.1
• Обновитесь до 18.1-1
• Обновитесь до 18.1-1ubuntu1

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

• Обновитесь до 13.23
• Обновитесь до 14.20
• Обновитесь до 14.20-0ubuntu0.22.04.1
• Обновитесь до 15.15
• Обновитесь до 15.15-0+deb12u1
• Обновитесь до 16.11
• Обновитесь до 16.11-0ubuntu0.24.04.1
• Обновитесь до 17.7
• Обновитесь до 17.7-0+deb13u1
• Обновитесь до 17.7-0ubuntu0.25.10.1
• Обновитесь до 18.1
• Обновитесь до 18.1-1
• Обновитесь до 18.1-1ubuntu1

Redis: Bug in XACKDEL may lead to stack overflow and potential RCE

Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

CVE-2025-53069

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2

CVE-2025-53067

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVE-2025-53062

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2

CVE-2025-53054

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2

CVE-2025-53053

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2

CVE-2025-53045

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2

CVE-2025-53044

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2

CVE-2025-53042

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2

CVE-2025-53040

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

• Обновитесь до 8.0.44-0ubuntu0.22.04.1
• Обновитесь до 8.0.44-0ubuntu0.24.04.1
• Обновитесь до 8.0.45-0ubuntu0.20.04.1+esm2
• Обновитесь до 8.4.7-0ubuntu0.25.10.2
• Обновитесь до 8.4.7-0ubuntu2