Description:
The Group Replication group_replication_disable_member_action UDF does not honor the explicit lengths of its action and event string arguments when they contain embedded NUL bytes. Valid canonical identifiers followed by an embedded NUL and a nonempty suffix are accepted as the canonical identifiers.
Actual result:
The call returns OK and disables mysql_disable_super_read_only_if_primary for AFTER_PRIMARY_ELECTION, changing ENABLED from 1 to 0:
NAME EVENT ENABLED
mysql_disable_super_read_only_if_primary AFTER_PRIMARY_ELECTION 1
malformed_call
OK
NAME EVENT ENABLED
mysql_disable_super_read_only_if_primary AFTER_PRIMARY_ELECTION 0
Expected result:
The UDF should reject the action and event byte strings because each contains an embedded NUL followed by a nonempty suffix, and the canonical member action should remain ENABLED=1. Length-bearing UDF arguments must be compared using their full supplied lengths rather than C-string termination semantics.
Impact:
Malformed action and event identifiers can silently target and change the state of canonical Group Replication member actions, making configuration operations act on a different identifier than the supplied byte string.
Tested versions:
MySQL 26.7.0 and MySQL 9.7.2.
Environment and configuration:
/usr/sbin/mysqld Ver 26.7.0 for Linux on x86_64 (MySQL Community Server - GPL)
/usr/sbin/mysqld Ver 9.7.2 for Linux on x86_64 (MySQL Community Server - GPL)
Source SHA: e174239c5b3c2bcf164649042ab8a7fc972ce88d
The group_replication plugin was ACTIVE.
How to repeat:
INSTALL PLUGIN group_replication SONAME 'group_replication.so';
SELECT NAME, EVENT, ENABLED
FROM performance_schema.replication_group_member_actions
WHERE NAME = 'mysql_disable_super_read_only_if_primary'
AND EVENT = 'AFTER_PRIMARY_ELECTION';
SELECT group_replication_disable_member_action(
CONCAT('mysql_disable_super_read_only_if_primary', _binary 0x00, 'suffix'),
CONCAT('AFTER_PRIMARY_ELECTION', _binary 0x00, 'suffix')
) AS malformed_call;
SELECT NAME, EVENT, ENABLED
FROM performance_schema.replication_group_member_actions
WHERE NAME = 'mysql_disable_super_read_only_if_primary'
AND EVENT = 'AFTER_PRIMARY_ELECTION';
Suggested fix:
Use the explicit UDF argument lengths for action and event identifiers and perform bounded comparisons over the complete byte strings, rejecting identifiers containing unmatched trailing bytes after an embedded NUL.
© 2026, Oracle Corporation and/or its affiliates
Description: The Group Replication group_replication_disable_member_action UDF does not honor the explicit lengths of its action and event string arguments when they contain embedded NUL bytes. Valid canonical identifiers followed by an embedded NUL and a nonempty suffix are accepted as the canonical identifiers. Actual result: The call returns OK and disables mysql_disable_super_read_only_if_primary for AFTER_PRIMARY_ELECTION, changing ENABLED from 1 to 0: NAME EVENT ENABLED mysql_disable_super_read_only_if_primary AFTER_PRIMARY_ELECTION 1 malformed_call OK NAME EVENT ENABLED mysql_disable_super_read_only_if_primary AFTER_PRIMARY_ELECTION 0 Expected result: The UDF should reject the action and event byte strings because each contains an embedded NUL followed by a nonempty suffix, and the canonical member action should remain ENABLED=1. Length-bearing UDF arguments must be compared using their full supplied lengths rather than C-string termination semantics. Impact: Malformed action and event identifiers can silently target and change the state of canonical Group Replication member actions, making configuration operations act on a different identifier than the supplied byte string. Tested versions: MySQL 26.7.0 and MySQL 9.7.2. Environment and configuration: /usr/sbin/mysqld Ver 26.7.0 for Linux on x86_64 (MySQL Community Server - GPL) /usr/sbin/mysqld Ver 9.7.2 for Linux on x86_64 (MySQL Community Server - GPL) Source SHA: e174239c5b3c2bcf164649042ab8a7fc972ce88d The group_replication plugin was ACTIVE. How to repeat: INSTALL PLUGIN group_replication SONAME 'group_replication.so'; SELECT NAME, EVENT, ENABLED FROM performance_schema.replication_group_member_actions WHERE NAME = 'mysql_disable_super_read_only_if_primary' AND EVENT = 'AFTER_PRIMARY_ELECTION'; SELECT group_replication_disable_member_action( CONCAT('mysql_disable_super_read_only_if_primary', _binary 0x00, 'suffix'), CONCAT('AFTER_PRIMARY_ELECTION', _binary 0x00, 'suffix') ) AS malformed_call; SELECT NAME, EVENT, ENABLED FROM performance_schema.replication_group_member_actions WHERE NAME = 'mysql_disable_super_read_only_if_primary' AND EVENT = 'AFTER_PRIMARY_ELECTION'; Suggested fix: Use the explicit UDF argument lengths for action and event identifiers and perform bounded comparisons over the complete byte strings, rejecting identifiers containing unmatched trailing bytes after an embedded NUL.