What is the CVSS score of CVE-2026-22009?

CVE-2026-22009 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22009?

Yes, a patch is available for CVE-2026-22009. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-22009

EUVD-2026-24316 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-f2mm-qgp8-rc9q

Denial Of Service Oracle Mysql Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable Optimizer flaw requiring only low-privileged credentials; scope unchanged, purely availability impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:35 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24316

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server's Optimizer component allows any low-privileged authenticated user with network access to trigger a complete denial of service via an uncontrolled resource consumption flaw. Affected across three active release lines - 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0 - this vulnerability is broadly deployed given MySQL's ubiquity, but real-world exploitation risk is low: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation as 'none' and the attack as non-automatable, and no public exploit code exists at time of analysis. Oracle released a patch in the April 2026 Critical Patch Update.

Technical ContextAI

CWE-400 (Uncontrolled Resource Consumption) in MySQL Server's query Optimizer component, which is responsible for analyzing SQL statements and selecting efficient execution plans. A specially crafted query can cause the Optimizer to enter an uncontrolled processing loop or allocate unbounded resources, ultimately hanging or crashing the server process. The vulnerability spans three Oracle MySQL release trains (CPE: cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:*) and is present in packaged builds distributed by Red Hat and SUSE, indicating exposure extends into major enterprise Linux distributions. The multi-protocol exposure noted in the advisory means the flaw is reachable via standard MySQL TCP connections as well as any other supported client transport.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Exact patched version numbers beyond the stated upper bounds (post-8.0.45, post-8.4.8, post-9.6.0) should be confirmed directly from the Oracle advisory or via Red Hat Security Advisory and SUSE Security Update channels for packaged installations. If immediate upgrade is not feasible, restrict the pool of accounts that can issue arbitrary queries against the affected server - revoke unnecessary privileges and limit network access to the MySQL port (default 3306/TCP) exclusively to trusted application hosts via firewall rules, reducing the exploitable surface to pre-authorized application connections. Monitor for anomalous query patterns or repeated server restarts as an operational indicator of exploitation attempts. No workaround that eliminates the Optimizer code path is documented; patching is the authoritative fix.