What is the CVSS score of CVE-2026-22005?

CVE-2026-22005 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22005?

Yes, a patch is available for CVE-2026-22005. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-22005

EUVD-2026-24307 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-8833-3jph-2h9h

Denial Of Service Oracle Mysql Server

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

PR:H confirmed by Oracle and description; network reachability required but high-privilege credential gates exploitation; pure availability impact with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:36 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24307

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server's Optimizer component crashes or hangs when high-privileged authenticated attackers submit crafted SQL queries over the network, affecting all active release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The uncontrolled resource consumption (CWE-400) results in complete availability loss for the database service, though confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and EPSS at 0.04% (11th percentile) places this among the lowest-exploitation-probability CVEs, consistent with the SSVC determination of no active exploitation.

Technical ContextAI

The vulnerability resides in the Optimizer subsystem of Oracle MySQL Server - the component responsible for parsing SQL statements, evaluating execution plans, and selecting query strategies. CWE-400 (Uncontrolled Resource Consumption) indicates the root cause is a failure to bound computational or memory resources during optimizer processing, likely triggered by a pathological SQL construct that causes the optimizer to enter an unrecoverable loop or consume excessive system resources until the server process hangs or crashes. The multi-protocol attack surface (CVSS AV:N) reflects that MySQL exposes the flaw over both the classic MySQL protocol (default TCP/3306) and the X DevAPI protocol (TCP/33060). Affected CPE is cpe:2.3:a:oracle_corporation:mysql_server covering three distinct version branches as documented in the Oracle Critical Patch Update April 2026.

RemediationAI

Apply the Oracle Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. The advisory covers all three affected branches (8.0.x, 8.4.x, and 9.x); exact patched version numbers were not stated in the available input data and should be confirmed directly from the Oracle advisory before deployment. Red Hat and SUSE users should apply their distribution security errata rather than Oracle's upstream packages to ensure compatibility. Where immediate patching is not feasible, restrict network access to MySQL ports 3306 and 33060 using host-based or network firewall rules to limit connectivity to trusted administrative hosts only - note this reduces external attack surface but does not protect against malicious insiders who already hold high-privilege credentials. Additionally, audit and minimize the number of accounts holding high-privilege (DBA-level) roles to reduce the pool of potential threat actors. These compensating controls do not remediate the underlying flaw and should be treated as temporary measures only.