What is the CVSS score of CVE-2026-22004?

CVE-2026-22004 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22004?

Yes, a patch is available for CVE-2026-22004. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-22004

EUVD-2026-24305 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-cccj-xpm5-2hpx

Denial Of Service Oracle Mysql Server

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

High-privileged network access is required to trigger InnoDB resource exhaustion; no confidentiality or integrity impact applies, only complete availability loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:37 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24305

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in MySQL Server's InnoDB component allows a high-privileged, network-connected attacker to cause the server to hang or crash repeatedly, achieving complete availability disruption. All three active release branches are affected: 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and CISA SSVC confirms no active exploitation - placing this firmly in a patch-and-monitor posture rather than emergency response.

Technical ContextAI

MySQL Server's InnoDB storage engine is the default transactional backend for all affected versions, responsible for row-level locking, MVCC, crash recovery, and buffer pool management. CWE-400 (Uncontrolled Resource Consumption) indicates that a specially crafted operation - likely a query or DDL/DML statement targeting InnoDB internals - exhausts a server resource (CPU cycles, memory allocation, or internal lock structures) beyond the engine's ability to recover, resulting in a hang or crash loop. Because InnoDB is enabled by default and used by virtually every MySQL database, no non-default configuration is required to expose the vulnerable code path. The CPE string cpe:2.3:a:oracle_corporation:mysql_server covers Oracle's own MySQL packages as well as downstream redistributions tagged under Red Hat and SUSE.

RemediationAI

The primary remediation is upgrading to a fixed MySQL Server release beyond the affected version ceilings: upgrade 8.0.x installations past 8.0.45, 8.4.x installations past 8.4.8, and 9.x installations past 9.6.0, per Oracle's April 2026 CPU advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Red Hat and SUSE users should apply the respective vendor-specific MySQL errata packages. An exact fixed version number was not independently confirmed from the available data beyond Oracle's statement that a patch is available - verify the target upgrade version against the advisory before deployment. Where immediate patching is not feasible, the most effective compensating control is auditing and restricting MySQL accounts holding SUPER or equivalent high-privilege grants to the minimum necessary set of trusted administrative users, since exploitation is gated on PR:H; revoking unnecessary elevated grants eliminates the attack surface entirely. Additionally, restricting network-level access to MySQL's listening port (default 3306) to only authorized administrative hosts via firewall rules reduces exposure, though this does not address insider or post-compromise scenarios.