Changes in MySQL Router 26.10.0 (2026-10-20)

• Functionality Added or Changed

• Bugs Fixed

Functionality Added or Changed

• MySQL Router's default TLS cipher list no longer includes DHE-RSA-AES128-GCM-SHA256, DHE-RSA-AES256-GCM-SHA384, DHE-RSA-AES128-CCM, DHE-RSA-AES256-CCM, and DHE-RSA-CHACHA20-POLY1305. These suites remain available when explicitly selected using client_ssl_cipher, server_ssl_cipher, or the HTTP server ssl_cipher option. (Bug #39744404)

• MySQL Router can now asynchronously reload configured TLS certificates, private keys, CA files, and certificate revocation lists without restarting. Reloading applies to routing TLS in both directions, the HTTPS server, and metadata-cache TLS connections. Existing connections and handshakes retain their current TLS state, while new connections use successfully validated replacement material; invalid or unreadable material leaves the affected owner using its previous usable state without preventing other owners from reloading. Only TLS material at paths accepted during startup is reread; mysqlrouter.conf, TLS modes, cipher suites, addresses, and ports are not reloaded. POSIX systems support SIGHUP, direct PID or PID-file targeting, and packaged systemd or SysV reload actions; Windows services use a service-specific named event. Example commands are:

          mysqlrouter --reload-tls --pid=PID
          mysqlrouter --reload-tls --pid-file=PATH
          mysqlrouter --reload-tls --service-name=NAME
          systemctl reload mysqlrouter.service

  Reload requests are asynchronous and do not wait for file validation. (WL #17271)

Bugs Fixed

• COM_CHANGE_USER authentication could return 1045 despite a correct password when caching_sha2_password required full authentication, the client-to-Router connection used TLS, and the Router-to-server connection did not. This authentication path now initializes RSA output correctly and propagates OpenSSL initialization or encryption failures instead of sending invalid authentication data. (Bug #40022146, Bug #121279)

• Fixed an issue relating to MySQL REST Service access checks. (Bug #39364154)

• An early client connection after MySQL Router restarted could stop the read-write listener on port 6446 while the PRIMARY destination set was temporarily empty before the initial metadata refresh. The port could remain inaccessible even after refresh found a usable destination; listener-state reconciliation now reopens it. A warning similar to the following could be logged:

  No available servers found for PRIMARY routing

  (Bug #39215253)

• After a transient network failure, every destination for a read-write route could be quarantined, causing MySQL Router to stop listening and fail to reopen the port after a backend recovered. The route then remained unavailable until MySQL Router was restarted. Quarantine recovery now reopens read-write ports for metadata-cache and static routes. The MySQL Router log could contain an error similar to the following:

  2026-07-30 00:00:30 routing ERROR [7fa983fff640] [routing:bootstrap_rw] 
  connecting to backend(s) for client from <ip> failed: connect(<ip>): 
  is quarantined, end of destinations: no more destinations

  (Bug #38256424)