MySQL Server CVE-2026-101609

Exploitation requires the attacker to already possess HIGH privileges on the target MySQL Server or MySQL Cluster instance (CVSS PR:H) and network reachability over one of MySQL's supported protocols (AV:N); no end-user interaction is needed (UI:N). The flaw resides specifically in the InnoDB storage engine component. Key limiting factors: Oracle rates this 'difficult to exploit' (AC:H), meaning a reliable trigger depends on specific conditions/timing rather than a simple request; the required high-privilege authentication effectively restricts realistic abuse to already-trusted or compromised database accounts; and impact is confined to availability (hang or repeatable crash) with no confidentiality or integrity effect. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuinely low-priority issue despite being a CRITICAL-sounding 'complete DOS' in the description. The CVSS 3.1 base score is only 4.4 (Medium), and the vector tells the real story: AV:N (network) but AC:H (high attack complexity - Oracle explicitly calls it 'difficult to exploit') and PR:H (attacker must already hold high privileges on the MySQL Server/Cluster instance). Impact is availability-only (C:N/I:N/A:H) with no scope change (S:U) - no data disclosure, no code execution, no privilege escalation. All exploitation signals point away from urgency: no CISA KEV listing, no public POC identified, and no EPSS score was provided in the input (absence of EPSS is a data gap, not a low score - it cannot be used either way here). An SSVC-style read would be: Exploitation=none observed, Automatable=no (high-privilege precondition and high complexity defeat mass automation), Technical Impact=partial (DoS only). The combination of PR:H + AC:H means a successful attacker is almost certainly an already-trusted/authenticated database user, making this closer to an insider or post-compromise abuse case than an external threat. No conflicting signals were observed between the CVSS vector and the description - both agree on network vector, high privilege, and availability-only impact.

An attacker who already holds high database privileges connects to the MySQL Server or Cluster over a supported network protocol and issues a specially crafted sequence that exercises a flaw in the InnoDB storage engine, driving the server into a hang or a repeatable crash that produces a complete denial of service. Because the flaw is availability-only, no data is read or altered - the payoff is downtime. No public exploit code has been identified, and the high attack complexity means a reliable trigger is non-trivial to develop.