MySQL Connector/J CVE-2026-101678

Exploitation requires that an application using MySQL Connector/J 26.7.0 be induced to communicate with an attacker-controlled or attacker-influenced server endpoint over one of the supported protocols - i.e., this is a client-side vulnerability in the JDBC driver, not a flaw in the MySQL server itself. The limiting factor is the required human interaction (UI:R): a person other than the attacker must perform the action that initiates the vulnerable connection, so the attacker cannot trigger it autonomously. Impact is confined to partial availability of the connector (A:L, S:U) with no data exposure or modification, which further bounds realistic risk.

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3, MEDIUM) shows the only impact is a partial, availability-only effect (A:L) with no confidentiality or integrity consequence - consistent with Oracle's own description of a 'partial denial of service' of the Connector/J client. Two signals materially reduce real-world urgency: the attack requires user interaction (UI:R), meaning exploitation is not self-propagating or scriptable at scale, and the scope is unchanged (S:U), so only the connector process is affected, not a backend database. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no exploitation probability to weigh against severity. The signals are internally consistent rather than conflicting (network vector plus required interaction fits a client-side driver that must be induced to connect to a malicious endpoint). No SSVC decision data was supplied. Overall: a real but minor DoS affecting client availability, appropriate for routine patch-cycle remediation rather than emergency response.

An attacker stands up a malicious or compromised endpoint that a Java application using MySQL Connector/J 26.7.0 is induced to connect to; crafted server responses over a supported protocol trigger a fault that partially disrupts the connector's availability. Because UI:R applies, a user or application operator must initiate the connection to the attacker-influenced server for the attack to succeed. No public exploit code is referenced for this CVE at time of analysis.