CVE Tools
Track your stack

Mysql2

7 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Mysql2, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Mysql2 CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Mysql2 CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-081
2026-091
2026-100

Severity

How the 7 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical240%
  • High120%
  • Medium240%

Latest CVEs

The 7 most recently published vulnerabilities affecting Mysql2.

  1. GHSA-3f6p-5ww8-9rcrMySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials—
  2. GHSA-rgwj-5xj2-c3m3MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS—
  3. CVE-2024-21512Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.8.2
  4. CVE-2024-21511Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL S...9.8
  5. CVE-2024-21508Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.9.8
  6. CVE-2024-21507Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) characte...6.5
  7. CVE-2024-21509Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser...6.5

Product grouping is registry-driven, with AI assist and human review. How it works