What is the CVSS score of CVE-2026-34270?

CVE-2026-34270 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34270?

Yes, a patch is available for CVE-2026-34270. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-34270

EUVD-2026-24345 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-7642-f8gh-qxjj

Denial Of Service Oracle Mysql Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible plugin requires low-privileged authentication; resource exhaustion produces only availability impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:28 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24345

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Uncontrolled resource consumption in the MySQL Server Group Replication Plugin enables low-privileged, network-accessible attackers to cause a complete denial of service - forcing MySQL Server into a hang or repeatedly reproducible crash across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Oracle has released a patch via its April 2026 Critical Patch Update, and no active exploitation has been identified at time of analysis. EPSS stands at 0.04% (12th percentile) and SSVC classifies exploitation as 'none' and the attack as non-automatable, indicating low real-world exploitation probability despite a medium CVSS score.

Technical ContextAI

The affected component is MySQL Server's Group Replication Plugin, a built-in high-availability and clustering mechanism that coordinates state synchronization across multiple MySQL instances using consensus protocols. CWE-400 (Uncontrolled Resource Consumption) is the root cause class, indicating the plugin fails to properly bound or throttle resource usage when processing certain inputs or protocol messages, leading to exhaustion of server resources. The affected CPE is cpe:2.3:a:oracle_corporation:mysql_server across the 8.0, 8.4, and 9.x release trains, all of which ship the Group Replication Plugin. Tags from aggregators (Oracle, Red Hat, SUSE) confirm the vulnerability is relevant to multiple Linux distribution packaging ecosystems that bundle MySQL.

RemediationAI

The primary remediation is to apply Oracle's Critical Patch Update from April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Based on the affected version ceiling data (≤8.0.45, ≤8.4.8, ≤9.6.0), the fix versions are inferred to be 8.0.46+, 8.4.9+, and 9.6.1+ or later within the 9.x train respectively - however, exact patched version numbers are not independently confirmed from available data and should be verified against the Oracle CPU advisory directly. If immediate patching is not feasible, compensating controls include disabling the Group Replication Plugin if clustering is not operationally required (note: disabling replication will remove HA capability), restricting network-level access to MySQL ports (default 3306 and replication ports 33060/33061) via firewall to trusted hosts only, and auditing MySQL accounts to revoke unnecessary privileges from users who do not require replication access. Red Hat and SUSE users should additionally monitor vendor-specific errata channels for updated packages.