# CVE-2022-4899: mecab: MySQL is a multi-user, multi-threaded SQL database server

CVE-2022-4899 is fixed in 18 products on 1 platform, first by DEBIAN-CVE-2022-4899, released March 31, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-4899
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0159
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 31, 2023

## Description

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.  Security Fix(es):  * mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911)  * mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933)  * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982)  * mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962)  * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953, CVE-2023-21955)  * mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966)  * mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972)  * mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980)  * mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057)  * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008)  * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112)  * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033)  * mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046, CVE-2023-22054, CVE-2023-22056)  * mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053)  * mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058)  * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114)  * mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111)  * mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115)  * mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960)  * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963)  * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964)  * mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967)  * mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968)  * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969)  * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-20970, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982)  * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981)  * mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983)  * mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984)  * mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985)  * zstd: mysql: buffer overrun in util.c (CVE-2022-4899)  * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038)  * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048)  * mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  Bug Fix(es):  * Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (RHEL-22452)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libzstd Debian 12.15 (bookworm) | 1.5.4+dfsg2-1 | [DEBIAN-CVE-2022-4899](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4899.md) | Mar 31, 2023 |
| Linux | libzstd Debian 13.5 (trixie) | 1.5.4+dfsg2-1 | [DEBIAN-CVE-2022-4899](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4899.md) | Mar 31, 2023 |
| Linux | libzstd Debian 14 | 1.5.4+dfsg2-1 | [DEBIAN-CVE-2022-4899](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4899.md) | Mar 31, 2023 |
| Linux | libzstd amzn 2023 | 1.5.2-1.amzn2023.0.3 | [ALAS2023-2023-244](https://patchblox.com/security/data/fix/linux/alas2023-2023-244.md) | Jul 5, 2023 |
| Linux | libzstd-debuginfo amzn 2023 | 1.5.2-1.amzn2023.0.3 | [ALAS2023-2023-244](https://patchblox.com/security/data/fix/linux/alas2023-2023-244.md) | Jul 5, 2023 |
| Linux | libzstd-devel amzn 2023 | 1.5.2-1.amzn2023.0.3 | [ALAS2023-2023-244](https://patchblox.com/security/data/fix/linux/alas2023-2023-244.md) | Jul 5, 2023 |
| Linux | libzstd-static amzn 2023 | 1.5.2-1.amzn2023.0.3 | [ALAS2023-2023-244](https://patchblox.com/security/data/fix/linux/alas2023-2023-244.md) | Jul 5, 2023 |
| Linux | mecab RHEL 8 | 0:0.996-2.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab almalinux 8 | 0.996-2.module_el8.6.0+3340+d764b636 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab ol 8 | 0:0.996-2.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mecab rocky 8 | 0:0.996-2.module+el8.10.0+1676+9b4b6e24 | [RLSA-2024:0894](https://patchblox.com/security/data/fix/linux/rlsa-2024-0894.md) | May 7, 2025 |
| Linux | mecab-devel RHEL 8 | 0:0.996-2.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab-devel almalinux 8 | 0.996-2.module_el8.6.0+3340+d764b636 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab-devel ol 8 | 0:0.996-2.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mecab-ipadic RHEL 8 | 0:2.7.0.20070801-16.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab-ipadic almalinux 8 | 2.7.0.20070801-16.module_el8.6.0+3340+d764b636 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab-ipadic ol 8 | 0:2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mecab-ipadic rocky 8 | 0:2.7.0.20070801-16.module+el8.10.0+1676+9b4b6e24 | [RLSA-2024:0894](https://patchblox.com/security/data/fix/linux/rlsa-2024-0894.md) | May 7, 2025 |
| Linux | mecab-ipadic-EUCJP RHEL 8 | 0:2.7.0.20070801-16.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab-ipadic-EUCJP almalinux 8 | 2.7.0.20070801-16.module_el8.6.0+3340+d764b636 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mecab-ipadic-EUCJP ol 8 | 0:2.7.0.20070801-16.0.1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql RHEL 8 | 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql RHEL 9 | 0:8.0.36-1.el9_3 | [RHSA-2024:1141](https://patchblox.com/security/data/fix/linux/rhsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql almalinux 8 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql almalinux 9 | 8.0.36-1.el9_3 | [ALSA-2024:1141](https://patchblox.com/security/data/fix/linux/alsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql ol 8 | 0:8.0.36-1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql ol 9 | 0:8.0.36-1.el9_3 | [ELSA-2024-1141](https://patchblox.com/security/data/fix/linux/elsa-2024-1141.md) | Mar 6, 2024 |
| Linux | mysql rocky 8 | 0:8.0.36-1.module+el8.10.0+1676+9b4b6e24 | [RLSA-2024:0894](https://patchblox.com/security/data/fix/linux/rlsa-2024-0894.md) | May 7, 2025 |
| Linux | mysql-common RHEL 8 | 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-common RHEL 9 | 0:8.0.36-1.el9_3 | [RHSA-2024:1141](https://patchblox.com/security/data/fix/linux/rhsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-common almalinux 8 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-common almalinux 9 | 8.0.36-1.el9_3 | [ALSA-2024:1141](https://patchblox.com/security/data/fix/linux/alsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-common ol 8 | 0:8.0.36-1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql-common ol 9 | 0:8.0.36-1.el9_3 | [ELSA-2024-1141](https://patchblox.com/security/data/fix/linux/elsa-2024-1141.md) | Mar 6, 2024 |
| Linux | mysql-devel RHEL 8 | 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-devel RHEL 9 | 0:8.0.36-1.el9_3 | [RHSA-2024:1141](https://patchblox.com/security/data/fix/linux/rhsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-devel almalinux 8 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-devel almalinux 9 | 8.0.36-1.el9_3 | [ALSA-2024:1141](https://patchblox.com/security/data/fix/linux/alsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-devel ol 8 | 0:8.0.36-1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql-devel ol 9 | 0:8.0.36-1.el9_3 | [ELSA-2024-1141](https://patchblox.com/security/data/fix/linux/elsa-2024-1141.md) | Mar 6, 2024 |
| Linux | mysql-errmsg RHEL 8 | 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-errmsg RHEL 9 | 0:8.0.36-1.el9_3 | [RHSA-2024:1141](https://patchblox.com/security/data/fix/linux/rhsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-errmsg almalinux 8 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-errmsg almalinux 9 | 8.0.36-1.el9_3 | [ALSA-2024:1141](https://patchblox.com/security/data/fix/linux/alsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-errmsg ol 8 | 0:8.0.36-1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql-errmsg ol 9 | 0:8.0.36-1.el9_3 | [ELSA-2024-1141](https://patchblox.com/security/data/fix/linux/elsa-2024-1141.md) | Mar 6, 2024 |
| Linux | mysql-libs RHEL 8 | 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-libs RHEL 9 | 0:8.0.36-1.el9_3 | [RHSA-2024:1141](https://patchblox.com/security/data/fix/linux/rhsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-libs almalinux 8 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-libs almalinux 9 | 8.0.36-1.el9_3 | [ALSA-2024:1141](https://patchblox.com/security/data/fix/linux/alsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-libs ol 8 | 0:8.0.36-1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql-libs ol 9 | 0:8.0.36-1.el9_3 | [ELSA-2024-1141](https://patchblox.com/security/data/fix/linux/elsa-2024-1141.md) | Mar 6, 2024 |
| Linux | mysql-server RHEL 8 | 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-server RHEL 9 | 0:8.0.36-1.el9_3 | [RHSA-2024:1141](https://patchblox.com/security/data/fix/linux/rhsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-server almalinux 8 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-server almalinux 9 | 8.0.36-1.el9_3 | [ALSA-2024:1141](https://patchblox.com/security/data/fix/linux/alsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-server ol 8 | 0:8.0.36-1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql-server ol 9 | 0:8.0.36-1.el9_3 | [ELSA-2024-1141](https://patchblox.com/security/data/fix/linux/elsa-2024-1141.md) | Mar 6, 2024 |
| Linux | mysql-test RHEL 8 | 0:8.0.36-1.module+el8.9.0+21207+6c20cb3d | [RHSA-2024:0894](https://patchblox.com/security/data/fix/linux/rhsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-test RHEL 9 | 0:8.0.36-1.el9_3 | [RHSA-2024:1141](https://patchblox.com/security/data/fix/linux/rhsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-test almalinux 8 | 8.0.36-1.module_el8.9.0+3735+82bd6c11 | [ALSA-2024:0894](https://patchblox.com/security/data/fix/linux/alsa-2024-0894.md) | Feb 20, 2024 |
| Linux | mysql-test almalinux 9 | 8.0.36-1.el9_3 | [ALSA-2024:1141](https://patchblox.com/security/data/fix/linux/alsa-2024-1141.md) | Mar 5, 2024 |
| Linux | mysql-test ol 8 | 0:8.0.36-1.module+el8.9.0+90153+70413b10 | [ELSA-2024-0894](https://patchblox.com/security/data/fix/linux/elsa-2024-0894.md) | Feb 21, 2024 |
| Linux | mysql-test ol 9 | 0:8.0.36-1.el9_3 | [ELSA-2024-1141](https://patchblox.com/security/data/fix/linux/elsa-2024-1141.md) | Mar 6, 2024 |
| Linux | zstd amzn 2023 | 1.5.2-1.amzn2023.0.3 | [ALAS2023-2023-244](https://patchblox.com/security/data/fix/linux/alas2023-2023-244.md) | Jul 5, 2023 |
| Linux | zstd-debuginfo amzn 2023 | 1.5.2-1.amzn2023.0.3 | [ALAS2023-2023-244](https://patchblox.com/security/data/fix/linux/alas2023-2023-244.md) | Jul 5, 2023 |
| Linux | zstd-debugsource amzn 2023 | 1.5.2-1.amzn2023.0.3 | [ALAS2023-2023-244](https://patchblox.com/security/data/fix/linux/alas2023-2023-244.md) | Jul 5, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.