MySQL Server CVE-2026-101731

Exploitation requires an authenticated session as a HIGH-PRIVILEGED MySQL user (CVSS PR:H) with network reachability to the MySQL Server or MySQL Cluster listener over one of the supported protocols; the malicious input must exercise the Server: Optimizer component. There is no user-interaction requirement (UI:N) and complexity is low (AC:L), so the crash is reliably triggerable once privileged access is held. The decisive limiting factor is the high-privilege prerequisite: an unprivileged or read-only account cannot trigger it, which sharply narrows the realistic attacker population to insiders or actors who have already compromised a privileged database credential. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuinely moderate, not high-priority, issue and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 4.9 (MEDIUM) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - network-reachable and low-complexity, but gated by PR:H, meaning the attacker already needs high database privileges before exploitation. Impact is confined to availability (A:H) with no confidentiality or integrity effect: the result is a hang or repeatable crash (complete DoS) of the Optimizer/server, not data compromise or code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit referenced, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The requirement for pre-existing high privileges substantially limits real-world risk: an actor able to authenticate as a high-privileged MySQL user can typically already disrupt the service by other means, so this adds marginal attacker capability. Net: a legitimately MEDIUM availability bug that should be patched in the normal Oracle CPU cycle rather than emergency-patched, absent any exploitation evidence.

An attacker who has already obtained high-privilege credentials to a MySQL Server or Cluster instance connects over the network via one of the supported protocols and submits a crafted query that drives the Optimizer into a pathological state, hanging or repeatably crashing the server for a complete denial of service. No user interaction is required, and because AC:L the trigger is reliable once privileged access exists, but no public proof-of-concept is identified at time of analysis. Confidentiality and integrity are unaffected - the sole outcome is service outage.