What is the CVSS score of CVE-2026-34267?

CVE-2026-34267 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34267?

Yes, a patch is available for CVE-2026-34267. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-34267

EUVD-2026-24342 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-3gfg-g579-3wmq

Denial Of Service Oracle Mysql Server

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network vector confirmed by MySQL's typical deployment model; PR:H required because triggering the Optimizer flaw demands authenticated high-privilege SQL execution; availability-only impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24342

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Uncontrolled resource consumption in the Optimizer component of MySQL Server 8.0.0 through 8.0.45 enables a high-privileged, network-connected attacker to cause a complete denial of service via a hang or repeatable crash. The impact is availability-only - no confidentiality or integrity risk exists - and the CVSS vector (PR:H) confirms exploitation is gated behind high-level database credentials. Oracle addressed this in the April 2026 Critical Patch Update; no active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.04% (11th percentile) reflects minimal observed exploitation probability.

Technical ContextAI

The vulnerability resides in MySQL Server's Optimizer subsystem - the component responsible for parsing SQL statements and generating query execution plans. CWE-400 (Uncontrolled Resource Consumption) indicates the Optimizer fails to bound resource usage when processing a pathological or specially crafted SQL query, leading to unbounded CPU, memory, or thread exhaustion consistent with a 'query of death' pattern. The CPE identifier (cpe:2.3:a:oracle_corporation:mysql_server) confirms the scope is Oracle's MySQL Server product, specifically the 8.0.x branch. MySQL 8.0's Optimizer introduced significant enhancements (hash joins, hypergraph optimizer) that expand the attack surface for such resource exhaustion conditions. The CVSS vector AV:N reflects that MySQL is commonly exposed over the network on port 3306/TCP, though PR:H limits who can actually trigger the condition.

RemediationAI

The primary fix is to upgrade MySQL Server to a version beyond 8.0.45 per Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html); Oracle has confirmed patch availability, though the exact fixed release number is not specified in available data and should be verified against the advisory. As compensating controls prior to patching: restrict network access to MySQL port 3306/TCP to only trusted application hosts using firewall rules, reducing the network-reachable attack surface; audit and revoke excessive privileges from accounts that do not require SUPER or DBA-level access, directly limiting who can submit optimizer-stressing queries; and leverage MySQL 8.0 Resource Groups to cap per-user CPU and thread consumption, which may blunt the impact of a triggered DoS at the cost of minor administrative overhead. Red Hat and SUSE users should monitor their respective security channels for backported patches.