MySQL Server CVE-2026-22005

Exploitation requires possession of a MySQL account granted high-level privileges, such as a database administrator or a user with SUPER or equivalent privileges (PR:H per the CVSS vector). The attacker must have network-level reachability to the target MySQL Server on any supported protocol - the CVSS vector (AV:N) confirms this is a network-delivered attack requiring no local system access. No user interaction is required (UI:N) and the flaw is present in default server configurations within the affected version ranges - no special optional feature or configuration setting is identified as a prerequisite beyond privilege level. Exploitation is explicitly limited by the high-privilege credential requirement: unauthenticated users and standard low-privilege database users cannot trigger the vulnerability. The SSVC automatable:no rating reflects that credential acquisition cannot be automated at scanning scale, preventing mass exploitation campaigns.

The real-world risk of this vulnerability is meaningfully lower than a raw availability-critical label would suggest. The CVSS PR:H requirement is the dominant limiting factor: exploitation is gated behind a valid high-privilege database credential such as a DBA or administrative account, which sharply constrains the attacker population to malicious insiders or actors who have already compromised privileged credentials through a separate attack. SSVC corroborates this: exploitation status is none, automatable is no (credential possession prevents mass scanning), and technical impact is only partial in SSVC terms. EPSS at 0.04% (11th percentile) confirms the statistical rarity of observed exploitation attempts. There is no KEV listing and no known public POC. The divergence between a network-accessible vector and the high privilege requirement is consistent with the description - this is not a pre-authentication flaw but one exercisable only by users already operating within the trust boundary of MySQL administration. Red Hat and SUSE advisories indicate this is being addressed in distribution-packaged MySQL builds, which broadens the practical patching scope beyond Oracle's own packages.

An attacker who has obtained valid high-privilege MySQL credentials - either a compromised DBA account or a malicious insider - connects to the MySQL Server over the network and submits a specially crafted SQL statement targeting the Optimizer component. The malformed query triggers uncontrolled resource consumption within the optimizer, causing the MySQL Server process to hang indefinitely or crash, and the condition is reliably reproducible, enabling sustained denial of service for all dependent applications and database consumers. No public exploit code is known at time of analysis.