CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

databases/mysql97-server9.7.2_3

Multithreaded SQL database (server)

Maintainer
joneum@FreeBSD.org
Packages
mysql97-server 9.7.2_3
Upstream
Higher version available: 26.10.0
CPE
oracle:mysql_server from the port
WWW
https://www.mysql.com/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range this version has left.

CVE-2026-46936, CVE-2026-47008, CVE-2026-47012, CVE-2026-47023, CVE-2026-47052, CVE-2026-47064, CVE-2026-60145, CVE-2026-60163, CVE-2026-60174, CVE-2026-60177, CVE-2026-60178, CVE-2026-60181, CVE-2026-60182, CVE-2026-60183, CVE-2026-60184, CVE-2026-60185, CVE-2026-60186, CVE-2026-60187, CVE-2026-60188, CVE-2026-60189, CVE-2026-60190, CVE-2026-60191, CVE-2026-60194, CVE-2026-60195, CVE-2026-60311, CVE-2026-60314, CVE-2026-60315, CVE-2026-60316, CVE-2026-60324, CVE-2026-60331, CVE-2026-60332, CVE-2026-60585, CVE-2026-60718, CVE-2026-60725, CVE-2026-60747, CVE-2026-61081, CVE-2026-61093, CVE-2026-61094, CVE-2026-61096, CVE-2026-61108, CVE-2026-61109, CVE-2026-61128, CVE-2026-61144

Commits (11)

Jochen Neumeister (joneum) · 9.7.2_3
databases/mysql*-server: make the rc script service jail aware

Set a default of net_basic for the service jail options, so mysqld
can use IPv4/IPv6 when it is started in a service jail. The default
can be overridden via rc.conf.

PR:		279672
Sponsored by:	Netzkommune GmbH
443408a666
Jochen Neumeister (joneum) · 9.7.2_2
databases/mysql97-server: Add maintainer note per new ports policy

The maintainer load and port lifecycle policy only excludes a port from the
outdated ratio when the reason is documented in the port itself:

	https://wiki.freebsd.org/Ports/MaintainerLoadAndPortLifecyclePolicy

repology merges every MySQL release series into a single project and measures
each of them against the newest train upstream ships. At the time of writing it
lists 26.7.0 as the newest MySQL and therefore reports this port as outdated,
although it carries 9.7.2, the latest release of its own series. The 26.x train
is not packaged in the tree at all, so this is a measurement artifact rather
than a pending update.

No functional change, comment only.

Sponsored by:	Netzkommune GmbH
1456e7bf4a
Jochen Neumeister (joneum) · 9.7.2_2
databases/mysql{80,84,97}-server: Fix build on CPUs without SSE4.2

The crc32 code declares target("sse4.2"), but the _mm_crc32_* intrinsics
require the crc32 feature. With -mno-crc32, as emitted by -march=native
on a CPU without the instruction, sse4.2 no longer implies crc32 and the
build fails. Declare crc32 instead, including the two flatten wrappers that
inline those intrinsics.

PR:		275404
Sponsored by:	Netzkommune GmbH
3c9444219a
Jochen Neumeister (joneum) · 9.7.2_2
databases/mysql{80,84,97}-server: Add rc script and user for MySQL Router

All three server ports build and install MySQL Router, but it was never
usable out of the box: there is no mysqlrouter user, no rc script, no
configuration directory, and no log, runtime or data directory. The only
trace of an integration was etc/logrotate.d/mysqlrouter, whose
"create 600 mysqlrouter mysqlrouter" refers to an account that no port
creates, so logrotate(8) skipped that entry with an error and exited
non-zero.

Upstream names that account itself: scripts/CMakeLists.txt sets
MYSQLROUTER_USER to "mysqlrouter", the built-in help of mysqlrouter
suggests --user=mysqlrouter, and the systemd unit shipped for Linux runs
the service under it.

Add the user and group, an rc script, and a configuration sample in
etc/mysqlrouter. mysqlrouter does not detach itself, so it runs under
daemon(8), which also writes the PID file that the postrotate script in
etc/logrotate.d/mysqlrouter expects. The runtime, log and data
directories
are created by the rc script, and only when they are missing, so a host
that already runs MySQL Router under a different account keeps working
untouched. This matches the init script in upstream's own packaging.

The service is off by default.

PR:		253245
Sponsored by:	Netzkommune GmbH
3f2328fca5
Jochen Neumeister (joneum) · 9.7.2_1
databases/mysql*-server: Fix plist issue

Move LICENSE.router and README.router from ${PREFIX} to ${DOCSDIR},
where they belong according to hier(7).

PR:		290283
Reported by:	se
Sponsored by:	Netzkommune GmbH
b32bea4a27
Jochen Neumeister (joneum) · 9.7.2
databases/mysql97-{client,server}: Update to 9.7.2

This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 43 of the 54 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.

Drop patch-libs_mysql_gtid_tag__plain.h, the type_traits include
is upstream as of 9.7.2.

Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-2.html

Security:	10f5f76e-90a5-11f1-bc30-3497f65b111b
Sponsored by:	Netzkommune GmbH
e04b81ba66
Jochen Neumeister (joneum) · 9.7.1_2
databases/mysql{84,97}: Install man pages, clean up dependencies

Re-enable installation of the man pages shipped in the source tarball
and register them in pkg-plist, split between the client and server
packages. Same approach as databases/mysql80-client in PR 279234.

Rework the dependencies based on actual linkage: libfido2 is only used
by the client, curl, icu and liblz4 only by the server. Drop libhidapi
entirely, it is a transitive dependency of libfido2.

While here, fix the CONFLICTS_INSTALL pattern of mysql84-client not
matching mysql80-client and update the mysql84 pkg-message.

Sponsored by:	Netzkommune GmbH
273edb702d
Jochen Neumeister (joneum) · 9.7.1_1
databases/mysql97: Fix build with llvm 21, directory ownership and cleanup

- Add upstream patches for missing #include <type_traits> and <cstdlib>,
  fixing the build with clang/libc++ 21 [1] [2]
- Register MY_SECDIR and MY_TMPDIR with mysql:mysql 0750 in pkg-plist,
  so mysqld no longer fails to start after package upgrades reset the
  ownership to root [3]
- Fix CONFLICTS_INSTALL pattern in the client not matching
  mysql80-client
  and align it with the wildcard style used by the server
- Update pkg-message for 9.x: mysql_upgrade no longer exists, the server
  performs upgrade tasks itself; fix version reference and quoting
- Drop duplicate -DWITH_LZ4=system, remove a stale line continuation,
  whitespace fixes
- Rename patch-sql_server_component_mysql__file__imp.cc to follow the
  patch naming convention

PR:		296439 [1], 296443 [2], 296758 [3]
Reported by:	Trond Endrestøl [1] [2], Alexander Ushakov [3]

sponsored by:	Netzkommune GmbH
95fe3eb151
Jochen Neumeister (joneum) · 9.7.1
databases/mysql97-{server|client}: Update to 9.7.1

Changelog: https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-1.html

Sponsored by:	Netzkommune GmbH
e8703e9aed
Bernhard Froehlich (decke) · 9.7.0
databases/mysql97-server: Fix CPE information
070e579b64
Jochen Neumeister (joneum) · 9.7.0
databases/mysql97-{server|client}: add new Ports

Welcome MySQL 9.7 - the LTS Version from MySQL 9

What is new in MySQL9.7: https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-0.html

Sponsored by:	Netzkommune GmbH
ee6bdb9a92