What is the CVSS score of CVE-2026-22017?

CVE-2026-22017 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22017?

Yes, a patch is available for CVE-2026-22017. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-22017

EUVD-2026-24329 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-3f4r-x789-hx5r

Denial Of Service Oracle Mysql Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network reachable with low complexity; low-privilege credential required (PR:L); pure availability impact with no confidentiality or integrity effect applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:32 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24329

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server's Optimizer component allows a low-privileged, network-connected attacker to repeatedly crash or hang the database server across three active release trains. Affected versions span 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0, representing a wide swath of currently deployed MySQL installations. Oracle confirmed a patch in the April 2026 Critical Patch Update; no public exploit code exists and EPSS remains at 0.04% with SSVC exploitation status of none, though the breadth of affected versions and low attack complexity make patching a meaningful operational priority for any network-accessible deployment.

Technical ContextAI

The vulnerability resides in the Server: Optimizer component of Oracle MySQL Server, classified under CWE-400 (Uncontrolled Resource Consumption). The MySQL Optimizer is responsible for query plan generation and execution strategy selection; a specially crafted SQL query can trigger resource exhaustion within this subsystem, causing the server process to hang or crash. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the flaw is reachable over the network via multiple protocols with low attack complexity, requiring only a low-privileged database account - no exploitation of transport-layer specifics is needed. CPE data (cpe:2.3:a:oracle_corporation:mysql_server) covers all three major version trains. The flaw is tagged by both Red Hat and SUSE, indicating downstream Linux distribution security advisories are in scope alongside Oracle's upstream CPU.

RemediationAI

The primary remediation is to upgrade MySQL Server to a fixed version per Oracle's April 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpuapr2026.html. Patch availability is confirmed by Oracle, but exact target fix versions (e.g., 8.0.46+, 8.4.9+, or a 9.x successor) are not independently verifiable from the references provided - consult the CPU advisory and Oracle's MySQL release notes directly for the precise patched builds. Red Hat and SUSE users should apply distribution-provided security updates, which may package the fix ahead of or alongside Oracle's upstream release. As a compensating control pending patching, restrict network access to MySQL's default TCP port 3306 using firewall or security group rules, limiting connectivity to trusted application hosts only; this reduces the attacker pool but does not eliminate risk for multi-user or shared-access deployments. The principle of least privilege should also be enforced to minimize the number of accounts capable of submitting complex Optimizer-engaging queries.