Percona Server for MySQL 9.2.0-1 → 26.7.0-1
7 releases · 0 breaking changes · 8 security fixes · 0 advisories fixed
8security0breaking0deprecated39feature19fix
Breaking changes
None in the release notes.
Security changes
- security CVE-2026-46850: A vulnerability in MySQL Shell (Shell for Visual Studio Code) allows a low-privileged attacker with network access via Hypertext Transfer Protocol (HTTP) to compromise MySQL Shell, with potential scope change impact on additional products (Common Vulnerability Scoring System (CVSS)… in 9.7.1-1
- security CVE-2026-46860: A vulnerability in MySQL Router allows an unauthenticated attacker with network access via HTTP to compromise MySQL Router (CVSS 3.1 Base Score 9.8). in 9.7.1-1
- security CVE-2026-46861: A vulnerability in MySQL NDB Cluster (NDB Operator) allows a low-privileged attacker with network access via HTTP to access or modify critical data, with potential scope change impact (CVSS 3.1 Base Score 9.6). in 9.7.1-1
- security CVE-2026-46862: A vulnerability in MySQL Router allows an unauthenticated attacker with network access via Transport Layer Security (TLS) to cause MySQL Router to stop responding or exit unexpectedly in a repeatable manner (CVSS 3.1 Base Score 7.5). in 9.7.1-1
- security CVE-2026-46863: A vulnerability in MySQL Server connection handling allows an unauthenticated attacker with network access via multiple protocols to cause the server to stop responding or exit unexpectedly in a repeatable manner (CVSS 3.1 Base Score 7.5). in 9.7.1-1
- security CVE-2026-46869: A vulnerability in MySQL Shell (Dump and Load) allows an unauthenticated attacker with network access to access critical data when user interaction is required (CVSS 3.1 Base Score 6.5). in 9.7.1-1
- security CVE-2026-46870: A vulnerability in MySQL Shell (Shell for Visual Studio Code) allows a low-privileged attacker with network access to compromise MySQL Shell, with potential scope change impact (CVSS 3.1 Base Score 8.5). in 9.7.1-1
- security CVE-2026-46871: A vulnerability in MySQL Shell (Shell for Visual Studio Code) allows a low-privileged attacker with network access via multiple protocols to access critical data (CVSS 3.1 Base Score 6.5). in 9.7.1-1
Every release in between
featureUnder certain circumstances, when adding an AUTO_INCREMENT column to an existing table, some records in that table could be skipped, resulting in inaccurate values in the AUTO_INCREMENT column. (Bug #115136, Bug #37105825)
featureDuring a buffer-pool resize, Adaptive Hash Index could be disabled in mysqld-auto.cnf even though innodb_adaptive_hash_index=ON. (Bug #39157211)
featureFixed a debug assertion in row_upd_rec_in_place() for non-versioned ROW_FORMAT=REDUNDANT rows. (Bug #39165747)
featureFixed an issue relating to table maintenance and clean-up. (Bug #39091376)
featureFixed an issue relating to unique indexes. (Bug #38501299)
featurePS-10849, PS-10999, PS-11065, PS-11220, and PS-11316: Percona Server for MySQL 9.7 now supports OpenID Connect (OIDC), allowing users to authenticate through compatible external identity providers. The server validates JWTs and audience claims, maps identity-provider groups to MySQL roles, and…
featurePS-11167: Added SQL functions for calculating the distance between vector values. Applications can use these functions to measure vector similarity and support search, recommendation, and other vector-based workloads. See DISTANCE()
featurePS-11120: Reduced page-level mutex contention when many concurrent sessions perform range-select queries against the same InnoDB pages. This change improves throughput and reduces waits for workloads that repeatedly access hot data.
featurePS-11216: Group Replication communication debug traces now include timestamps. Administrators can more easily identify, sequence, and correlate events when troubleshooting large GCS_DEBUG_TRACE files.
featurePS-11413: Improved validation and logging for errors in JSON-based OIDC configuration files. Invalid configuration sections are no longer silently ignored, and the server log provides clearer information to help diagnose configuration problems.
featurePS-11444: Reduced the time that InnoDB holds the buffer pool LRU list mutex during physical page reads. This change decreases serialization and improves scalability for I/O-intensive workloads.
featurePS-11445: Restored a dedicated LRU manager thread for each buffer pool instance. Moving LRU flushing work away from page-cleaner threads improves buffer pool maintenance under heavy workloads.
featurePS-11446: Corrected an LRU boundary check that caused scans to restart unnecessarily. LRU scans now continue through eligible pages as intended, reducing repeated work and improving flushing efficiency.
featurePS-11447: Improved how InnoDB obtains free pages while an LRU batch flush is running. User threads can perform a controlled single-page flush when necessary and avoid repeated waits, improving responsiveness when the buffer pool is under pressure. New monitoring counters provide visibility into…
fixPS-8822: Fixed a performance regression affecting queries that use JOIN operations. The associated InnoDB optimizations reduce unnecessary processing and improve query performance.
fixPS-11135: Corrected a misleading error reported for invalid audit log filter definitions. The server now provides a more accurate message describing the configuration problem instead of incorrectly recommending a different event mode.
fixPS-11143: Fixed a server crash that could occur under connection-heavy workloads when the thread pool and certain Performance Schema instruments were enabled.
fixPS-11182: Starting a new audit_log_read() sequence now implicitly closes the previous sequence. Users no longer need to close each sequence manually before reading from another position.
fixPS-11186: The audit_log_read() function now honors the max_array_length setting when audit events use the JSON FULL or REDUCED format, ensuring that the returned result contains no more than the requested number of events.
fixPS-11202: The server now handles corrupted page-tracking files gracefully. It reports a warning and continues without the unavailable tracking information instead of exiting.
fixPS-11209: Fixed failures in concurrent Common Table Expression (CTE) queries that could incorrectly report error 1146 for missing internal temporary tables.
fixPS-11217: The Group Replication GCS_DEBUG_TRACE file can now be rotated and recreated without restarting Group Replication, simplifying extended debugging sessions.
fixPS-11248: Updated the documentation to clarify how externally assigned LDAP and OIDC roles are handled when group membership changes or authentication does not complete successfully.
fixPS-11253: Fixed a memory-safety issue in the external role-grant mechanism used by authentication plugins such as LDAP and OIDC. The server no longer accesses released memory while adding these roles to the privilege cache.
fixPS-11273: Fixed a secondary server crash that could occur while startup was being stopped because of an invalid authentication configuration. The server now reports the configuration error and exits cleanly.
fixPS-11297: Removed unnecessary record-offset validation from production builds, reducing InnoDB processing overhead and improving performance by up to 4.6% in tested Percona Server for MySQL 9.7 workloads.
featureConnection attribute parsing could read a length-encoded size field before verifying that the complete field was present in the packet, leading to an out-of-bounds read. A size check is now performed before reading the field. (Bug #39116965)
featureA regression in row size estimation for ROW_FORMAT=COMPRESSED tables could cause CREATE TABLE to fail with Row size too large for tables that were accepted in earlier releases. (Bug #39129182, Bug #120323)
featureUnder certain circumstances, when calculating the maximum possible index record size, an assertion failure could occur. (Bug #85060, Bug #25579578)
featureIntegrated the new Key Management Interoperability Protocol (KMIP) library into the key management component.
featureExpanded Thread Pool statistics with status variables for queue monitoring and wait time analysis.
featureIntroduced JSONL (JSON Lines) output format for Audit Log Filter.
featureIncreased data dictionary upgrade logging verbosity to aid diagnosis of upgrade failures.
featureExtended Audit Log Filter logging so the table_access class records read and insert statements.
featureChanged audit log shutdown behavior to flush the buffer when the ASYNCHRONOUS logging strategy is in use.
featureReduced memory pressure in the Audit Log Filter component caused by virtual file system (VFS) buffering.
featureAligned audit_log_filter.format=NEW behavior between the 8.0 plugin and the 8.4 component.
featureSuppressed nested general/status records in Audit Log Filter output when audit_log_filter.event_mode=REDUCED was enabled.
featureRemoved format=OLD and set JSONL as the default Audit Log Filter output format.
featureOptimized performance of mem_root_deque.
securityCVE-2026-46850: A vulnerability in MySQL Shell (Shell for Visual Studio Code) allows a low-privileged attacker with network access via Hypertext Transfer Protocol (HTTP) to compromise MySQL Shell, with potential scope change impact on additional products (Common Vulnerability Scoring System (CVSS)…
securityCVE-2026-46860: A vulnerability in MySQL Router allows an unauthenticated attacker with network access via HTTP to compromise MySQL Router (CVSS 3.1 Base Score 9.8).
securityCVE-2026-46861: A vulnerability in MySQL NDB Cluster (NDB Operator) allows a low-privileged attacker with network access via HTTP to access or modify critical data, with potential scope change impact (CVSS 3.1 Base Score 9.6).
securityCVE-2026-46862: A vulnerability in MySQL Router allows an unauthenticated attacker with network access via Transport Layer Security (TLS) to cause MySQL Router to stop responding or exit unexpectedly in a repeatable manner (CVSS 3.1 Base Score 7.5).
securityCVE-2026-46863: A vulnerability in MySQL Server connection handling allows an unauthenticated attacker with network access via multiple protocols to cause the server to stop responding or exit unexpectedly in a repeatable manner (CVSS 3.1 Base Score 7.5).
securityCVE-2026-46869: A vulnerability in MySQL Shell (Dump and Load) allows an unauthenticated attacker with network access to access critical data when user interaction is required (CVSS 3.1 Base Score 6.5).
securityCVE-2026-46870: A vulnerability in MySQL Shell (Shell for Visual Studio Code) allows a low-privileged attacker with network access to compromise MySQL Shell, with potential scope change impact (CVSS 3.1 Base Score 8.5).
securityCVE-2026-46871: A vulnerability in MySQL Shell (Shell for Visual Studio Code) allows a low-privileged attacker with network access via multiple protocols to access critical data (CVSS 3.1 Base Score 6.5).
featurePS-10070: Integrated the new Key Management Interoperability Protocol (KMIP) library into the key management component.
featurePS-10083: Expanded Thread Pool statistics with new status variables for queue monitoring and wait time analysis. The new metrics report the number of requests waiting in normal and high-priority queues, the number of requests not yet entered into a queue, and aggregate queue wait time statistics,…
featurePS-10989: Introduced JSONL (JSON Lines) output format for Audit Log Filter.
featurePS-8867: Increased data dictionary upgrade logging verbosity to aid diagnosis of upgrade failures.
featurePS-9774: Extended Audit Log Filter logging so the table_access class and read and insert subclasses record statements in the audit log.
featurePS-10312: Changed audit log shutdown behavior to flush the buffer when the ASYNCHRONOUS logging strategy is in use, preventing loss of buffered events.
featurePS-10331: Reduced memory pressure in the Audit Log Filter component caused by virtual file system (VFS) buffering.
featurePS-10339: Aligned audit_log_filter.format=NEW behavior between the 8.0 plugin and the 8.4 component.
featurePS-10987: Suppressed nested general/status records in Audit Log Filter output when audit_log_filter.event_mode=REDUCED was enabled.
featurePS-11004: Removed format=OLD and set JSONL as the default Audit Log Filter output format.
featurePS-11161: Optimized performance of mem_root_deque.
fixPS-8670: InnoDB exited unexpectedly on startup while resuming an interrupted ALTER TABLESPACE encryption operation when progress was persisted before affected pages were flushed to disk.
fixPS-9773: Audit Log Filter audit_log_read() always returned "null" instead of bookmarked and current information.
fixPS-9791: After migration from the audit_log plugin to the audit_log_filter component, records did not include specific fields, which made logs difficult to use.
fixPS-10228: An audit log filter defined with no value did not log events.
fixPS-10338: audit_log_filter_set_filter() returned OK for filters that referenced unknown field names instead of reporting an error.
fixPS-10348: The Audit Log Filter did not support filtering by integer fields.
fixPS-10351: The Audit Log Filter logged an excessive number of events.
+22 more items in the release notes