MySQL Server CVE-2026-101743

Exploitation requires an authenticated low-privileged MySQL account (PR:L) with network reachability to the database over one of its supported protocols, and the attack targets the Server: GIS (spatial data) component - the attacker must be able to issue queries that exercise GIS/spatial functionality. There is no user interaction and attack complexity is low, so any valid low-privileged session can trigger it. Limiting factors: valid credentials are mandatory (not remote-unauthenticated), impact is restricted to availability (crash/hang DOS only, no data compromise), and only MySQL Server/Cluster versions 26.7.0 through 26.7.1 are affected.

This is a medium-severity, availability-only vulnerability (CVSS 3.1 base 6.5, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) in the MySQL Server/Cluster GIS component. The signals are internally consistent: network vector with low attack complexity makes the flaw easy to trigger, but PR:L means the attacker must already hold a low-privileged (authenticated) database account, which meaningfully narrows the exploitation population to insiders or attackers who have already obtained valid credentials. Impact is confined to availability (complete DOS via hang or repeatable crash) with no confidentiality or integrity effect and no scope change. No EPSS score was supplied, the CVE is not on the CISA KEV list, and no POC was provided, so there is no public exploit identified at time of analysis. Net assessment: this is a real but moderate-priority issue - patch it in normal cycles and prioritize for internet-exposed or multi-tenant MySQL instances where low-privileged accounts are broadly provisioned, but it is not a drop-everything critical given the authentication requirement and availability-only impact. Note the absence of EPSS/KEV/POC is a lack of signal, not evidence of safety.

An attacker holding a low-privileged MySQL account (e.g., an application service account or an untrusted tenant in a shared database) sends crafted GIS/spatial queries over a standard MySQL protocol connection. The malformed spatial input triggers a hang or repeatable crash in the Server: GIS component, producing a complete denial of service for the database instance and all dependent applications. No public exploit code has been identified at time of analysis.