MySQL Server CVE-2026-101725

Exploitation requires a valid low-privileged MySQL account (CVSS PR:L) with network reachability to the server over one of the supported client protocols; the flaw resides in the C API component of MySQL Server and MySQL Cluster. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. The primary limiting factor is the authentication requirement - unauthenticated attackers cannot trigger it - so risk is highest where low-privileged credentials are widely distributed (multi-tenant hosting, shared application databases) or where the database port is exposed beyond trusted networks. No user interaction or non-default configuration is indicated as a prerequisite.

This is a moderate-severity denial-of-service issue with a vendor-assigned CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vector signals favorable attacker conditions - network reachable, low attack complexity, no user interaction - but require low-level authentication (PR:L), which meaningfully constrains the attacker population to users who already hold valid MySQL credentials. Impact is confined to availability (A:H) with no confidentiality or integrity effect, so the realistic worst case is a hang or repeatable crash (complete DoS) rather than data compromise or code execution. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, and the issue is not in CISA KEV, so there is no confirmed active exploitation. Net assessment: this is a real but not top-tier priority - patch during normal Oracle Critical Patch Update cycles, prioritizing internet-exposed or multi-tenant MySQL instances where low-privileged accounts are broadly held. The 'easily exploitable' language in the Oracle description aligns with AC:L but should not be read as unauthenticated: the CVSS vector authoritatively requires PR:L.

An attacker holding a low-privileged MySQL account (e.g., a tenant or application database user) connects over the network via one of the supported client protocols and issues a crafted request that triggers a fault in the C API handling path. The server hangs or crashes repeatably, producing a complete denial of service for all dependent applications. No public exploit code is identified at time of analysis, and no user interaction is required.