CVE-2009-2446: Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld...

Security readout for executives and security teams

CVE-2009-2446 is an old MySQL server issue where an authenticated database user could crash the daemon by using malicious formatting characters in a database name. Business risk is mainly outage risk on legacy MySQL 4.x/5.0 deployments, with unspecified further impact noted but not detailed in the source bundle. Exposure is most likely in unsupported or legacy MySQL 4.0 and 5.0 environments, especially where authenticated users can create or drop databases. Internet exposure increases outage risk, but authentication is required. Treat as a targeted legacy exposure, not a broad emergency. Prioritize systems running obsolete MySQL with broad authenticated access or business-critical availability requirements. Mitigation focus: Upgrade affected MySQL deployments using applicable vendor security advisories.; Check Ubuntu, Red Hat, Apple, and other vendor guidance for fixed packages.; Remove unnecessary CREATE DATABASE and DROP DATABASE privileges from users..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.