What is the CVSS score of CVE-2026-22002?

CVE-2026-22002 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22002?

Yes, a patch is available for CVE-2026-22002. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-22002

EUVD-2026-24301 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-4h9j-w885-pqx6

Denial Of Service Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-accessible Optimizer crash requires mandatory DBA-level credentials (PR:H); only availability impacted, no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:37 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24301

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Uncontrolled resource consumption in the MySQL Server Optimizer component allows a high-privileged, network-accessible attacker to cause a complete denial of service across all three actively maintained release trains (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The Oracle April 2026 CPU addresses this flaw; no public exploit code is identified and EPSS stands at 0.04% (11th percentile), reflecting low real-world exploitation probability. The scope extends to MySQL Server packages distributed by Red Hat and SUSE, broadening the patching surface for enterprise Linux environments.

Technical ContextAI

The vulnerable component is MySQL Server's Optimizer - the subsystem responsible for query planning, cost estimation, and execution path selection. CWE-400 (Uncontrolled Resource Consumption) at this layer indicates that a crafted SQL query can cause the Optimizer to exhaust server-side resources (CPU cycles, memory, or internal locks), leading to a hang or crash of the mysqld process. The CPE string cpe:2.3:a:oracle_corporation:mysql_server covers all three release trains affected. The multi-protocol exposure noted in the description confirms that multiple MySQL connection protocols (classic MySQL protocol on 3306/TCP, X Protocol on 33060/TCP) can serve as delivery vectors for the malicious query. The Red Hat and SUSE tags indicate the vulnerability is present in distribution-packaged builds, not only upstream Oracle releases.

RemediationAI

Apply the Oracle April 2026 Critical Patch Update, which provides patched builds across all three affected release trains. The advisory at https://www.oracle.com/security-alerts/cpuapr2026.html contains version-specific fix information; exact patched version numbers are not enumerated in the available data and should be confirmed directly from the advisory. Red Hat and SUSE deployments should apply the relevant distribution updates through standard package management channels. As a compensating control pending patch deployment, restrict network access to MySQL ports (3306/TCP for classic protocol, 33060/TCP for X Protocol) to explicitly authorized hosts using firewall rules or network ACLs - this reduces the attack surface without eliminating the risk if an attacker already holds high-privilege credentials. Additionally, audit and minimize the number of accounts holding DBA-level privileges, as PR:H means valid high-privilege credentials are a hard prerequisite for exploitation.