Upgrade to MySQL Connector/J 26.7.0 in 4.1.x (CVE-2026-61082)
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- java, mysql
- Domain
- build-system, security
Research direction
Start with platform/spring-boot-dependencies/build.gradle and compare the Connector/J version and dependency upgrade policy with the 4.2.0-RC1 change in gh-52230. Check the 26.7.0 release notes and the 4.1.x branch's dependency management conventions. Done means the 4.1.x line manages the patched version with the required policy and relevant dependency checks pass.
Written by the indexing model from the issue text.
Description
gh-52230 upgraded the managed MySQL Connector/J version to 26.7.0 in 4.2.0-RC1.
The 4.1.x line currently manages MySQL Connector/J 9.7.0 (library("MySQL", "9.7.0") in platform/spring-boot-dependencies/build.gradle), which is affected by recently published security vulnerabilities:
- CVE-2026-61082 — information disclosure in MySQL Connector/J 9.7.0–9.7.1
- CVE-2026-60624 — MySQL Connectors, exploitable over the network by unauthenticated attackers
There does not appear to be a patched release on the 9.7.x line — the fix landed in 26.7.0, after Oracle moved Connector/J to the 26.x versioning scheme.
Would you consider applying the same upgrade to the 4.1.x branch? We understand 26.7.0 is a cross-major upgrade from 9.7.0 — the dependency upgrade policy in the build would need to be relaxed from same-major-version to any, as was done for the 4.2 commit in gh-52230 — but given the security impact we believe it is worth considering for the 4.1.x line as well.
Release notes: https://dev.mysql.com/doc/relnotes/connector-j/en/news-26-7-0.html
- Dominant language
- Java
- Stars
- 81.7k
- Forks
- 45.1k
- Avg merge
- 3d 11h
- Merged PRs (30d)
- 54
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from spring-projects/spring-boot
-
status: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
spring-projects/spring-boot#52347 ·
Maintainers usually reply within 2 days
-
status: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
spring-projects/spring-boot#52316 · 1 comment ·
Maintainers usually reply within 2 days
-
Maven process-test-aot only copies META-INF/native-image of the generated resources so the Logback configuration is lost in native testsPossibly taken @ZedingZhang claimed this 1 day ago. Openstatus: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
spring-projects/spring-boot#52301 · 3 comments ·
Maintainers usually reply within 2 days
-
status: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
spring-projects/spring-boot#52300 ·
Maintainers usually reply within 2 days
-
status: waiting-for-triage
Difficulty 1/5 Under an hour Newbie friendliness 75/100
spring-projects/spring-boot#52296 ·
Maintainers usually reply within 2 days
All issues in spring-projects/spring-boot
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
checkstyle/checkstyle#22145 ·
Maintainers usually reply within 1 day
-
rset command throws NPE in ResultsFormat.guessSyntaxPossibly taken @Ostrzyciel claimed this today. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
enhancement good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
objectionary/eo#9593 ·
Maintainers usually reply within 1 day
-
release bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenLiberty/open-liberty#36124 ·
Maintainers usually reply within 1 day