MySQL Server CVE-2026-101761

Exploitation targets the MySQL Server: Security: Encryption component and is reachable by an unauthenticated (PR:N) remote attacker over multiple MySQL network protocols, so no credentials or user interaction are required against a network-reachable instance. The primary limiting factor is high attack complexity (AC:H): Oracle explicitly describes it as 'difficult to exploit,' indicating the attacker must satisfy conditions outside their direct control (e.g., specific server state, timing, or race conditions) rather than firing a single deterministic request. Exploitation is further limited to availability - it can only hang or repeatedly crash the service and cannot read or modify data. Risk is reduced where MySQL is not exposed to untrusted networks (bound to localhost, firewalled, or restricted to trusted application hosts). Affected scope is limited to MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a moderate-severity, availability-only vulnerability (CVSS 3.1 5.9, A:H with C:N/I:N) that should be treated as a patch-in-normal-cycle issue rather than an emergency. Multiple signals agree it is lower real-world priority: the CVSS vector specifies AC:H (high attack complexity), meaning exploitation is not reliably repeatable and likely depends on timing, race conditions, or specific server state - Oracle's own wording 'difficult to exploit' reinforces this. There is no CISA KEV listing and no public exploit identified, so the exploitation status is theoretical at this time. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap, not evidence of low risk. The only meaningful risk amplifier is PR:N/AV:N: an unauthenticated attacker with network access over multiple protocols can trigger a complete denial of service. There are no conflicting signals (impact is cleanly availability-only), but note the input lists CWE as N/A, so the precise defect class (e.g., crash, hang, resource exhaustion) is unconfirmed and should be verified against Oracle's CPU October 2026 advisory.

An unauthenticated attacker on the network sends specially crafted traffic over one of MySQL's supported protocols to a reachable MySQL Server or Cluster node, targeting a flaw in the Server: Security: Encryption component. Because the condition is difficult to trigger (AC:H), the attacker may need to send repeated or precisely timed requests, but a successful attack hangs or repeatedly crashes the database for a complete DoS. No public proof-of-concept exploit has been identified at the time of analysis.