MySQL Server CVE-2026-34272

The attacker must possess a valid MySQL account with at minimum low-level privileges (PR:L) - any authenticated session suffices, including read-only users. The attack is delivered over the network via any MySQL-supported protocol (no specific protocol restriction stated). No special server configuration, non-default feature, or elevated role is required beyond basic authenticated connectivity. Exploitation is limited by the credential prerequisite: unauthenticated network scanners cannot trigger this flaw, and SSVC confirms 'Automatable: no' on this basis. The vulnerability affects only MySQL Server 9.0.0-9.6.0; 8.x and earlier versions are not in scope per Oracle's disclosure. Impact is strictly availability (DoS) - no data exfiltration or integrity modification is possible.

The CVSS 3.1 score of 6.5 (Medium) is driven entirely by availability impact - there is no confidentiality or integrity exposure. The vector AV:N/AC:L/PR:L/UI:N confirms network reachability with low complexity, but the PR:L requirement (valid database credentials) is a meaningful exploitation barrier. EPSS at 0.04% (12th percentile) indicates extremely low observed exploitation probability relative to all tracked CVEs, and SSVC independently corroborates this with exploitation status of 'none' and automatable of 'no' - the credential prerequisite prevents automated mass scanning from being effective. SSVC technical impact is assessed as 'partial' rather than 'total', suggesting graceful recovery may be possible in some crash scenarios. This vulnerability is not in CISA KEV. The aggregate signal is a real but low-urgency issue: a rogue or compromised low-privilege database user could disrupt availability, but opportunistic exploitation at scale is unlikely. Organizations with strict change windows may safely defer to the next maintenance cycle unless untrusted users have database login access.

An attacker with any valid low-privilege MySQL account - such as a read-only application user or a shared reporting account - connects to the MySQL server over the network using a standard MySQL client or connector. The attacker submits a specifically crafted SQL query designed to trigger a pathological code path in the Optimizer, causing the server process to hang indefinitely or crash, denying service to all legitimate users and applications dependent on the database. No public proof-of-concept has been identified at the time of analysis, so constructing such a query likely requires knowledge of the specific Optimizer code path.