MySQL 9.5.1 → 9.7.0

4 releases · 4 breaking changes · 13 security fixes · 3 advisories fixed

13security4breaking0deprecated11feature52fix

Is 9.5.1 affected? · What changed up to 26.10.0

Vulnerabilities fixed by this upgrade

5.0 CVE-2026-34317 Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vu…
5.8 CVE-2026-34318 Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Difficult to exploit…
5.0 CVE-2026-34319 Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vu…

Breaking changes

breaking Under certain circumstances, find_in_set() could return incorrect results. The optimization which caused this has been removed. Our thanks to Jingqi Tian for the contribution. (Bug #119995, Bug #39056621) in 9.7.0
breaking A number of unused symbols were removed from the code base. (Bug #38557463) in 9.6.0
breaking InnoDB: InnoDB redo logging error messages now include the current LSN and redo log capacity information. A new warning code ER_IB_WRN_REDO_DISABLED_INFO is added which includes the current LSN. A new error code ER_IB_MSG_LOG_WRITER_WAIT_ON_NEW_LOG_FILE_INFO is added to include the current log… in 9.6.0
breaking InnoDB: The field fk_max_recusive_level in dict_table_t struct is no longer used and has been removed. Our thanks to Xiaocong Ding for the contribution. (Bug #119063, Bug #38492574) in 9.6.0

Security changes

security Authentication now supports PBKDF2 storage format with Caching_sha2_password, providing enhanced security and flexibility. This update allows for the use of PBKDF2 with SHA512, enabling a smoother migration path from existing formats and ensuring even stronger security guarantees. With this… in 9.7.0
security MySQL Enterprise Edition 9.7.0 introduces dynamic data masking policies. These policies enable masking at the column level in the base table, enabling least-privilege access. The following SQL statements are added: The following SQL statements are updated to support masking policies: The following… in 9.7.0
security CREATE MASKING POLICY in 9.7.0
security DROP MASKING POLICY in 9.7.0
security SHOW CREATE MASKING POLICY in 9.7.0
security CREATE TABLE in 9.7.0
security ALTER TABLE ... ADD COLUMN in 9.7.0
security ALTER TABLE ... ALTER COLUMN in 9.7.0
security CURRENT_ROLE_IN(role1,role2,...): supports a comma-separated list of roles. in 9.7.0
security CURRENT_USER_IN(user1,user2,...): supports a comma-separated list of usernames. in 9.7.0
security Important Change: MySQL now supports enhanced security and flexibility with the relocation of MD5() and SHA1() SQL functions to a separate component, allowing for greater control over deprecated hashing algorithms and improved compliance with security standards. You can install the classic_hashing… in 9.6.0
security Fixed an issue relating to authentication. (Bug #118447, Bug #38077617) in 9.6.0
security The error message returned when attempting to create a user with an existing user name was unclear. (Bug #28331, Bug #11746738) in 9.6.0

Every release in between

9.7.0 Apr 7, 2026 Release notes ↗

fixDropping a database is now possible even if its corresponding directory is missing from the file system, maintaining a consistent state for the database. (Bug #38711166)

fixGenerated Invisible Primary Keys (GIPK) were added to tables even when UNIQUE NOT NULL keys existed, when sql_generate_invisible_primary_key=ON. If the unique key was auto-incremented, GIPK creation failed. As of this release, UNIQUE NOT NULL keys are treated as Primary Key-equivalent for CREATE…

fixApplying mysqlbinlog output failed while executing CREATE TABLE ... START TRANSACTION which were immediately followed by comments, preceded by #. Errors were returned similar to the following: ERROR 3977 (HY000) at line 117: Only BINLOG INSERT, COMMIT and ROLLBACK statements are allowed after…

fixIt was not possible to create tables with a Primary Key Equivalent if SQL_REQUIRE_PRIMARY_KEY was enabled. Errors were returned similar to the following: ERROR 3750 (HY000): Unable to create or change a table without a primary key, when the system variable 'sql_require_primary_key' is set. Add a…

fixIt was not possible to drop columns, on a table with virtual columns, using LOCK=NONE. (Bug #83557, Bug #24962142)

fixFixed an issue related to processing certain gzip files. The MySQL Server has been updated to relax the .gz header checks, allowing ordinary gzip files to be processed. Errors were returned similar to the following: Invalid audit log file content (Bug #38980223)

fixFixed an issue related to the audit_log_prune_seconds system variable. You can now set audit_log_prune_seconds. Checks have been added to ensure audit_log_prune_seconds does not exceed a certain threshold based on other system variable values, including log_offload.log_analytics_schedule and…

featureA new feature has been introduced that rotates the audit log file based on elapsed time, controlled by the new variable audit_log.rotate_on_time. (WL #17213)

featureAudit Log now supports automatic recovery from invalid filter configurations, ensuring that the server can start even if an invalid filter is found in the table. With this update, if an invalid filter configuration is detected, it will be replaced in- memory at startup with a default filter that…

securityAuthentication now supports PBKDF2 storage format with Caching_sha2_password, providing enhanced security and flexibility. This update allows for the use of PBKDF2 with SHA512, enabling a smoother migration path from existing formats and ensuring even stronger security guarantees. With this…

fixThe included zlib library has been upgraded to version 1.3.2. (Bug #38987448)

fixMicrosoft Windows: On Windows, MySQL Configurator did not validate group names defined with --named-pipe-full-access-group. As of this release, an error is returned if the group does not exist. (Bug #38068986)

fixWhen altering a table's character set, the date and time data type columns are converted in both the data dictionary and SDI. However, the new collation_id in SDI did not match that of the Field object. As of this release, ALTER TABLE ... CONVERT TO CHARACTER SET does not alter the character set…

fixFixed an issue relating to the DEFAULT() function. (Bug #39057054)

featureA new variable, replica_allow_higher_version_source, has been introduced that lets you enable or disable replication from a higher version source into a lower version replica. (WL #17202)

fixInnoDB: Under certain circumstances, removing a record could require merging B-tree pages and updating their parent page. InnoDB could underestimate the size of index records, causing it to acquire page latches in an unsafe order and potentially deadlock with a concurrent B-tree search. InnoDB now…

fixInnoDB: Fixed an issue relating to data directory location detection. (Bug #38169053)

fixMemory usage during FTS index construction for large tables has been optimized. (Bug #39040226)

fixFixed an issue relating to multi-value indexes. (Bug #39040128)

fixFixed an issue in the parallel reader. (Bug #39033858)

fixdict_sdi_create_idx_in_mem function added columns in a different order than expected, with the compressed_len and uncompressed_len fields swapped. (Bug #38810801)

fixUnder certain circumstances, running CREATE INDEX with a high value for --innodb_parallel_read_threads could cause the disk space to fill up, leading to disk space exhaustion. (Bug #38370155)

fixFixed an issue related to TRUNCATE TABLE. (Bug #38169053)

fixUnder certain circumstances, if the cgroups memory limit was set to a very high value, and --innodb-dedicated-server=ON, MySQL could fail to start. (Bug #37944614)

fixUnder certain circumstances, when calculating the maximum possible index record size, an assertion failure could occur. (Bug #85060, Bug #25579578)

fixFixed an issue relating to processing of JSON files. (Bug #39000847)

fixUsing the monthname function within a JSON scope resulted in an assertion error. Errors were returned similar to the following: Assertion `mtime.time_type == MYSQL_TIMESTAMP_DATE in JSON (Bug #38980997)

fixFixed an issue relating to optimized prepared DELETE and UPDATE statements. (Bug #39071552)

breakingUnder certain circumstances, find_in_set() could return incorrect results. The optimization which caused this has been removed. Our thanks to Jingqi Tian for the contribution. (Bug #119995, Bug #39056621)

securityMySQL Enterprise Edition 9.7.0 introduces dynamic data masking policies. These policies enable masking at the column level in the base table, enabling least-privilege access. The following SQL statements are added: The following SQL statements are updated to support masking policies: The following…

securityCREATE MASKING POLICY

securityDROP MASKING POLICY

securitySHOW CREATE MASKING POLICY

securityCREATE TABLE

securityALTER TABLE ... ADD COLUMN

securityALTER TABLE ... ALTER COLUMN

securityCURRENT_ROLE_IN(role1,role2,...): supports a comma-separated list of roles.

securityCURRENT_USER_IN(user1,user2,...): supports a comma-separated list of usernames.

featureX Protocol now supports PBKDF2 storage format with Caching_sha2_password. (Bug #38879953)

featureForeign key CASCADE and SET NULL actions performed by SQL-layer foreign key handling can now activate BEFORE and AFTER triggers on affected child rows. Enable this behavior for a session by setting the new enable_cascade_triggers system variable to ON. The default is OFF. Cascade-induced triggers…

+52 more items in the release notes

9.6.1 Jan 16, 2026 Release notes ↗

9.6.0 Dec 23, 2025 Release notes ↗

fixUpdated the audit_log_rotate_on_size system variable to require the AUDIT_ADMIN privilege for modification. (Bug #38620615)

featureMySQL now supports a more modular and efficient auditing system with the introduction of the Audit Log component. This update splits the monolithic Audit Log software into smaller, more manageable components, encapsulated into MySQL components, making it easier to install, manage, and maintain.…

fixMySQL Server's clang-tidy configuration now consistently disables all brace checks, including hicpp-braces-around-statements, to prevent duplicate diagnostics. (Bug #38601902)

breakingA number of unused symbols were removed from the code base. (Bug #38557463)

fixThe cmake macro MYSQL_CHECK_PROTOBUF did not properly handle multiple calls when using system protobuf. Errors were returned similar to the following: ADD_LIBRARY cannot create imported target "ext::libprotobuf" because another target with the same name already exists. (Bug #38417986)

fixThe mysqlx_port server variable was not persisted in the my.ini file when set through the Type and Networking configuration page. (Bug #38728671)

fixMySQL Configurator treated single-quotes (') as part of the password. The configurator now correctly handles quoted passwords by removing any quotes, double quotes, or backticks from the beginning and end of the password. (Bug #38069029)

fixServer file permissions were not applied as specified with --server-file-permissions-access. Full access was granted regardless of the value defined. (Bug #38068994)

fixslow-query-log-file could be used even if the slow query log was not enabled. (Bug #38068822)

fixIt was possible to set the --general-log-file CLI option when the general log was disabled. As of this release, an error is returned. (Bug #38068775)

fixopen-win-firewall could be used when TCP/IP connections were disabled. As of this release, --open-win-firewall can only be used when TCP/IP connections are enabled. (Bug #38068699)

fixUpdating the password with MySQL Configurator took a long time. (Bug #37459271)

fixA number of issues were corrected in the Server API documentation. Our thanks to Daniël van Eeden for the contribution. (Bug #114671, Bug #117516, Bug #37329988, Bug #37615382, Bug #36526371)

breakingInnoDB: InnoDB redo logging error messages now include the current LSN and redo log capacity information. A new warning code ER_IB_WRN_REDO_DISABLED_INFO is added which includes the current LSN. A new error code ER_IB_MSG_LOG_WRITER_WAIT_ON_NEW_LOG_FILE_INFO is added to include the current log…

fixInnoDB: If an XA PREPARED transaction existed during a server shutdown or crash, restarting the server with a non-zero --innodb-force-recovery value caused InnoDB to incorrectly change the transaction state from PREPARED to ACTIVE. This could lead to issues ranging from assertion failures to…

fixInnoDB: InnoDB now generates unique rowid values in tables without primary keys more efficiently. (Bug #13395168)

breakingInnoDB: The field fk_max_recusive_level in dict_table_t struct is no longer used and has been removed. Our thanks to Xiaocong Ding for the contribution. (Bug #119063, Bug #38492574)

fixInnoDB: If the server closed during transaction commit, transactions in an already committed state could remain in the undo log. If the transaction is already committed, it is cleared from trx_sys->rw_trx_list during recovery, but is not cleared from active_tw_trxs of the trx_sys->shards. This…

fixInnoDB: When selecting blob data after a small partial update, incorrect results may be returned due to inconsistencies in the Multi-Version Concurrency Control (MVCC) for blob objects. (Bug #114138, Bug #36342348)

fixInnoDB: Concurrent execution of FLUSH TABLE FOR EXPORT with DROP TABLE and DML operations could result in a deadlock. (Bug #110485, Bug #35221441)

fixFixed an issue related to bulk inserts. (Bug #38208188)

featureMySQL Server now supports a new startup option, container_aware, which controls the server's ability to discover and adhere to CPU and memory resource limits set by a container. (WL #16937)

fixGraalVM performance metrics are now available on Windows. (Bug #38498718)

fixThe SHOW CREATE LIBRARY command generated HEX representations of binary libraries on x86_64 architectures with FFFFFF patterns before each byte with the high bit set. Our thanks to Akshat Nehra and the team at Amazon for the contribution. (Bug #118927, Bug #38458235)

fixThe table IDs reported in the I_S views for JSON Duality Views differed from those reported by ORACLE DB due to differences in calculation order, leading to inconsistent REFERENCED_TABLE_ID values when multiple Content_tree_nodes referred to the same base table. (Bug #38624596)

featureOption Tracker now supports MySQL Shell and MySQL Shell for VS Code. The following status variables were added: The following system variable was added: See Option Tracker Component. (WL #16659, WL #17000)

fixFixed an issue relating to Common Table Expressions (CTE). (Bug #38573285)

fixUsing the coalesce or any_value functions with specific JSON operations, such as json_search and json_remove, could cause an assertion failure. (Bug #38549573)

fixNegative year values were accepted as valid datetime values by one method, but not by another. Negative year values are now always reported as errors. (Bug #38487373)

fixFixed issues relating to executing specific SELECT queries. (Bug #38465147, Bug #38465178)

fixFixed an issue related to executing specific SQL queries. (Bug #38448700)

fixFixed an issue relating to SHOW CREATE TABLE. (Bug #38298692)

fixAs of this release, GROUPING() is permitted in queries without ROLLUP. (Bug #38168051)

fixQueries which used REGEXP took longer to execute as prepared statements than as direct queries. (Bug #114056, Bug #36326728)

featureMySQL Server now supports a new GTID set data structure, providing a simpler, more modern, and efficient library for handling Global Transaction IDs. This implementation replaces the existing library, offering improved maintainability and performance. (WL #16076)

securityImportant Change: MySQL now supports enhanced security and flexibility with the relocation of MD5() and SHA1() SQL functions to a separate component, allowing for greater control over deprecated hashing algorithms and improved compliance with security standards. You can install the classic_hashing…

securityFixed an issue relating to authentication. (Bug #118447, Bug #38077617)

securityThe error message returned when attempting to create a user with an existing user name was unclear. (Bug #28331, Bug #11746738)

featureImportant Change: In previous releases, Foreign Key constraints and cascade operations were handled by the InnoDB storage engine. As of this release, they are handled by the SQL layer of the MySQL Server. This change allows for more comprehensive binary logs and improved analytics. This change is…

featureThe bundled version of opentelemetry-cpp was upgraded to version 1.23.0. (Bug #38483354)

+50 more items in the release notes

9.5.2 Nov 20, 2025 Release notes ↗