# Vitess v24.0.5

> Storage & Data · 2026-10-13

A security-focused maintenance release hardens SQL parsing, authorization, and connection handling. It also introduces operator-visible restrictions and migration actions, especially for SQL modes, character sets, and access controls.

## Action needed
- **[security]** Global `SET` variable-name injection fix, `GHSA-m282-7w35-g77m`
  - Vitess fixes SQL injection through a global `SET` variable name. This addresses `GHSA-m282-7w35-g77m`.
- **[security]** Date and time literal injection fix, `GHSA-9248-hccp-qf8f`
  - Vitess fixes SQL injection through `DATE`, `TIME`, and `TIMESTAMP` literals. This addresses `GHSA-9248-hccp-qf8f`.
- **[security]** `SET_VAR` session-value injection fix, `GHSA-9rx3-8pwm-c228`
  - Vitess fixes SQL injection through a session variable value carried in a `SET_VAR` hint. This addresses `GHSA-9rx3-8pwm-c228`.
- **[security]** Malformed numeric bind variable injection fix, `GHSA-xf67-9r78-xv82`
  - Vitess fixes SQL injection through malformed numeric bind variables. This addresses `GHSA-xf67-9r78-xv82`.
- **[breaking]** Empty `CHARACTER SET`, `COLLATE`, `ENGINE`, and `TABLESPACE` names rejected
  - Vitess now rejects empty `CHARACTER SET`, `COLLATE`, `ENGINE`, and `TABLESPACE` names.

## Check if affected
- **[security]** Restricted MySQL connection character sets
  - Applies if you configure `--db-charset`.
  - Vitess no longer accepts `sjis`, `cp932`, `gb18030`, `gbk`, `big5`, `ucs2`, `utf16`, `utf16le`, or `utf32` in `--db-charset` or other MySQL connection character set configuration points. This addresses `GHSA-c28j-qmfx-4gxp`.
- **[security]** The `VExplain` `execute` action requirement
  - Applies if you use `VExplain` and do not configure `execute`.
  - The affected modes now require the new `execute` action on the `VExplain` resource. This addresses `GHSA-c2r8-grjp-w8c8`.
- **[security]** `VStream` `LastPK` injection fix, `GHSA-73pp-99vw-h5g8`
  - Applies if you run `VStream`.
  - Vitess fixes SQL injection through `VStream` `LastPK` values. This addresses `GHSA-73pp-99vw-h5g8`.
- **[security]** `VStream` `convert_tz()` injection fix, `GHSA-92cc-q2h6-m2vr`
  - Applies if you run `VStream`.
  - Vitess fixes SQL injection through `convert_tz()` arguments in a `VStream` filter. This addresses `GHSA-92cc-q2h6-m2vr`.
- **[security]** Online DDL table-name injection fix, `GHSA-8w3p-4xg5-rm9w`
  - Applies if you run `Online DDL`.
  - Vitess fixes SQL injection through table names in Online DDL statements. This addresses `GHSA-8w3p-4xg5-rm9w`.
- **[security]** Query annotation caller-ID injection fix, `GHSA-x56j-8c72-5xgg`
  - Applies if you enable `--queryserver-config-annotate-queries`.
  - Vitess fixes SQL injection through the caller ID in query annotations controlled by `--queryserver-config-annotate-queries`. This addresses `GHSA-x56j-8c72-5xgg`.
- **[security]** Trailing-comment parsing and table ACL fix, `GHSA-pfg5-ppc7-ff45`
  - Applies if you use `table ACL` checks.
  - Vitess fixes SQL that was hidden from parsing and table ACL checks in a trailing comment. This addresses `GHSA-pfg5-ppc7-ff45`.
- **[security]** `VTAdmin` cross-site `GET` request restriction, `GHSA-3fr2-mqr5-r5x5`
  - Applies if you run `VTAdmin`.
  - `VTAdmin` API routes that change cluster state no longer accept cross-site `GET` requests. This addresses `GHSA-3fr2-mqr5-r5x5`.
- **[security]** RBAC enforcement for `VTAdmin` `ReloadSchemaShard`, `GHSA-78h7-x6qm-xpr8`
  - Applies if you run `VTAdmin`.
  - `VTAdmin`'s `ReloadSchemaShard` now checks RBAC. This addresses `GHSA-78h7-x6qm-xpr8`.
- **[breaking]** Stricter `sql_mode` assignment validation
  - Applies if you configure `sql_mode`.
  - Vitess now rejects an unsupported `sql_mode` even when the underlying MySQL server already uses that mode and the assignment would not change its value.

## Other recorded changes
- 15 (value_changed 7, constraint_changed 4, default_changed 2, defect_corrected 2)

[Full analysis](https://ratatosk.io/en/releases/vitess/v24.0.5)

[Original release notes](https://github.com/vitessio/vitess/releases/tag/v24.0.5)