MySQL Server CVE-2026-101799

Exploitation requires two concrete conditions drawn from the description: (1) the target MySQL Server or MySQL Cluster node must be running Group Replication, since the vulnerable component is specifically 'Server: Group Replication GCS' (the Group Communication System layer) - standalone MySQL instances without Group Replication configured are not exposed; and (2) the attacker must have access to the physical/adjacent communication segment attached to the hardware where MySQL executes (CVSS AV:A), meaning the same Layer-2 network as the node, not arbitrary internet reachability. No authentication is required (PR:N) and no user interaction is required (UI:N). The primary limiting factors are therefore the Adjacent-network positioning requirement and the dependency on Group Replication being enabled; impact is limited to availability (hang/repeatable crash), with no confidentiality or integrity effect. Affected versions: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a mid-severity availability-only flaw whose real-world risk is substantially constrained despite several signals. The vendor-supplied CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: AV:A (Adjacent) matches the stated requirement that the attacker have 'access to the physical communication segment attached to the hardware,' PR:N matches 'unauthenticated,' and C:N/I:N/A:H matches a pure denial-of-service (hang or repeatable crash) with no data exposure or integrity impact. The Adjacent vector is the single most important risk-limiting factor - this is NOT remotely exploitable across routed networks (AV:N), so an attacker must already be on the same L2 segment as the MySQL/Cluster node, which typically means a backend/cluster interconnect network rather than the internet. EPSS score, CISA KEV status, and public POC availability are all ABSENT from the provided intelligence; per precision rules this means 'no public exploit identified at time of analysis,' and the absence of KEV/EPSS is not itself evidence of safety but does mean there is no signal of active or probable exploitation. No SSVC decision data was provided. Oracle labels it 'easily exploitable' (consistent with AC:L), but the Adjacent-network precondition plus the requirement that Group Replication (GCS) be in use keeps this well below the priority of a network-facing unauthenticated RCE. Net: a legitimate patch-cycle item for MySQL deployments running Group Replication, not an emergency; the availability-only impact and Adjacent vector argue against widespread opportunistic exploitation.

An attacker positioned on the same physical/Layer-2 network segment as a MySQL Server or MySQL Cluster node running Group Replication sends crafted traffic to the Group Communication System (GCS) layer, without needing any credentials. The malformed input drives the server into a hang or a repeatable crash, producing a complete denial of service for the database node or cluster. No public exploit code is identified at time of analysis, and the Adjacent-network requirement means the attacker must already have a foothold on the cluster's communication segment.