What is the CVSS score of CVE-2026-21998?

CVE-2026-21998 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-21998?

Yes, a patch is available for CVE-2026-21998. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-21998

EUVD-2026-24295 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-x878-48g9-62p4

Denial Of Service Oracle Mysql Server

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-accessible Optimizer DoS requiring high-privilege credentials; no confidentiality or integrity impact; PR:H accurately reflects the mandatory DBA-level access prerequisite.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:38 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24295

CVE Published

Apr 21, 2026 - 20:34 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server's Optimizer component allows high-privileged, network-authenticated attackers to cause a complete crash or hang across three active release trains (8.0.x, 8.4.x, 9.x). The broad version coverage and multi-protocol attack surface are notable, but the PR:H requirement limits the attacker pool to actors who already hold elevated MySQL credentials. No public exploit has been identified and EPSS at 0.04% (11th percentile) confirms low observed exploitation probability; Oracle has released a patch via the April 2026 Critical Patch Update.

Technical ContextAI

The vulnerability resides in MySQL Server's Optimizer component, which is responsible for parsing, planning, and optimizing SQL query execution paths. CWE-400 (Uncontrolled Resource Consumption) indicates that a specially crafted query or optimizer input can exhaust server-side resources - CPU cycles, memory, or internal execution state - without adequate bounds enforcement, resulting in a hang or repeatable crash. The affected CPE (cpe:2.3:a:oracle_corporation:mysql_server) spans three major release trains (8.0, 8.4, and 9.x), suggesting the flaw exists in a shared optimizer code path rather than a version-specific feature introduced in one branch. Oracle's description that exploitation occurs 'via multiple protocols' means the attack surface includes MySQL's native client protocol as well as the X Protocol used by MySQL Shell and connectors, widening the exposure beyond traditional SQL clients.

RemediationAI

The primary fix is to upgrade MySQL Server to the patched version released as part of Oracle's Critical Patch Update for April 2026; consult https://www.oracle.com/security-alerts/cpuapr2026.html for the specific patched releases across the 8.0, 8.4, and 9.x trains - exact fix version numbers (e.g., 8.0.46, 8.4.9) are not explicitly enumerated in available reference data and should be confirmed directly from the Oracle advisory. Red Hat and SUSE users should apply distribution-provided MySQL package updates, as both vendors are tagged in associated advisories. As a compensating control prior to patching, restrict high-privilege MySQL account usage to audited, trusted hosts using MySQL's GRANT ... REQUIRE statements or network-level firewall rules limiting access to MySQL ports (default 3306/3306 X Protocol 33060); note this does not fix the underlying optimizer flaw and constitutes a defense-in-depth measure only. Additionally, review and minimize the number of accounts granted SUPER or DBA-equivalent privileges to reduce the attacker surface if credentials are compromised.