MySQL Server CVE-2026-101733

Exploitation requires the attacker to already hold a low-privileged, authenticated MySQL account (CVSS PR:L) with network reachability to the database over one of its supported protocols; the flaw resides in the Server: JSON component, so triggering it involves JSON-related query processing rather than a special configuration. No non-default feature toggle is documented as required and no user interaction is needed (UI:N). The key limiting factor is the authentication prerequisite - exploitation is NOT possible by fully unauthenticated attackers - which substantially reduces exposure on instances that are not internet-facing or multi-tenant. Impact is confined to availability (crash/hang); no data disclosure or modification occurs.

This is a medium-severity, availability-only denial-of-service flaw in the JSON component of Oracle MySQL Server and MySQL Cluster. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent: network vector, low complexity, low privileges required, no user interaction, with impact confined entirely to availability (C:N/I:N) - a repeatable crash or hang causing complete DOS. No EPSS score, KEV listing, or POC was provided in the input; the only tags are 'Denial Of Service' and 'Oracle', and the sole reference is the Oracle Critical Patch Update of October 2026. There is therefore no evidence of active exploitation or public exploit code - this is not a confirmed priority on exploitation grounds. The realistic risk is a post-authentication DoS: an attacker already holding a low-privileged MySQL account can crash the server, which matters most in multi-tenant, shared-hosting, or internet-exposed database deployments. Because confidentiality and integrity are untouched, this ranks below RCE or data-exposure bugs but should still be patched promptly on exposed or shared instances given MySQL's enormous deployment footprint. No conflicting signals were observed; the chief gap is the absence of EPSS/KEV/POC data to gauge likelihood of weaponization.

An attacker with a valid but low-privileged MySQL account connects over the network (e.g., via the standard MySQL protocol) and issues crafted queries that abuse the Server: JSON component, triggering a hang or repeatable crash that takes the database completely offline. No user interaction or elevated privileges are needed, and the crash can be repeated to sustain an outage. No public exploit identified at time of analysis.