MySQL Server CVE-2026-101616

Requires a valid low-privileged MySQL account (PR:L) with network access to the database over one of its supported client protocols; exploitation targets the Server: JSON component, so a query path exercising JSON functionality is needed. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. Limiting factors: authentication is mandatory (no anonymous exploitation), impact is restricted to denial of service with no data disclosure or modification, and no user interaction is involved. The requirement for valid credentials is the primary constraint reducing real-world exposure.

This is a moderate-priority, availability-only vulnerability in the MySQL Server/Cluster JSON component. The Oracle-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: network-reachable, low attack complexity, requires a low-privileged authenticated account, no user interaction, and the sole impact is a complete denial of service (hang or repeatable crash) with zero confidentiality or integrity impact. Oracle explicitly describes it as 'easily exploitable,' which aligns with AC:L. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. The key tempering factor is PR:L: the attacker must already hold a valid (even if unprivileged) database credential, which rules out anonymous internet-wide exploitation and makes this most relevant as an insider or post-compromise/credential-abuse DoS rather than a mass-exploitation threat. There is no missing or conflicting CVSS data here; the vector and prose agree. The main unknown is EPSS, which would normally help gauge real-world exploitation likelihood.

An attacker holding any low-privileged MySQL account (e.g., a compromised application database user) sends a crafted query exercising the JSON component over a standard client protocol, causing the server to hang or crash repeatedly and producing a complete denial of service. No public exploit code is identified at time of analysis, and because PR:L is required, the attacker must first obtain valid credentials.