EUVD-2026-24346
GHSA-8hfr-pcm2-774v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible DoS via low-privilege credentials; no confidentiality or integrity impact; scope unchanged per single-server crash outcome.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Uncontrolled resource consumption in Oracle MySQL Server's Group Replication Plugin allows a low-privileged authenticated network attacker to cause a complete denial of service - server hang or repeatable crash - across three major release lines (8.0.x, 8.4.x, and 9.x). The vulnerability carries a CVSS 3.1 score of 6.5 with network attack vector and low attack complexity, though real-world exploitation pressure is minimal: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation status as none and the attack as non-automatable, and no public exploit code has been identified at time of analysis. Oracle has released a patch via the April 2026 Critical Patch Update.
Technical ContextAI
The affected component is the MySQL Group Replication Plugin, a built-in MySQL high-availability mechanism enabling multi-primary or single-primary replication topologies over standard MySQL network protocols (TCP/IP, SSL). CWE-400 (Uncontrolled Resource Consumption) identifies the root cause as the plugin's failure to enforce bounds on resource usage - CPU cycles, memory, or connection state - when processing certain protocol-level inputs, allowing an attacker to exhaust server resources until the process hangs or crashes. The CPE (cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:*) spans Oracle-distributed MySQL packages, and downstream Red Hat and SUSE Linux distributions that package MySQL are also affected per advisory tags, meaning the exposure extends beyond Oracle's own releases to a broad enterprise Linux ecosystem.
RemediationAI
The primary remediation is upgrading to a fixed MySQL Server version beyond the affected ranges by applying Oracle's April 2026 Critical Patch Update, referenced at https://www.oracle.com/security-alerts/cpuapr2026.html. Exact target version numbers are not stated in the available data - consult the advisory directly for the precise fixed release in each branch (8.0.x, 8.4.x, 9.x). Red Hat and SUSE users should apply OS-level package updates as their respective security advisories become available. For environments where immediate patching is infeasible, restrict network access to MySQL Group Replication ports (default TCP 33060 for MySQL X Protocol and 33061 for Group Replication GCS) using firewall rules, limiting replication traffic to trusted peer IP addresses only - this reduces the attack surface to internal hosts that already hold low-privilege credentials. Alternatively, disabling Group Replication entirely eliminates exposure but removes high-availability topology, which may be an unacceptable trade-off for production clusters. Enforcing strict account hygiene - minimizing the number of low-privilege accounts and applying strong password policies - reduces the likelihood of credential-based access needed to trigger the vulnerability.
More in Mysql Server
View allA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. Rated critical severity (
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FT
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Rated critical severity (CVSS 9.8), this vul
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today