What is the CVSS score of CVE-2026-34272?

CVE-2026-34272 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

MySQL Server CVE-2026-34272

EUVD-2026-24347 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-3fhh-pgvh-2w97

Denial Of Service Oracle Mysql Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable Optimizer flaw requiring only low-privilege credentials; impact is pure availability with no confidentiality or integrity exposure and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:28 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24347

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server's Optimizer component in versions 9.0.0 through 9.6.0 is susceptible to uncontrolled resource consumption triggered by a low-privileged authenticated attacker over the network, resulting in a complete denial of service via hang or repeated crash. The attack surface spans multiple protocols and requires no user interaction beyond valid database credentials. No public exploit code has been identified and exploitation probability is minimal (EPSS 0.04%, SSVC exploitation: none), but the low complexity and broad version range make it relevant for any organization running MySQL 9.x in multi-tenant or externally reachable deployments.

Technical ContextAI

The vulnerability resides in the MySQL Server Optimizer - the query planning and execution engine responsible for generating efficient query execution plans. CWE-400 (Uncontrolled Resource Consumption) indicates that a specially crafted query or sequence of queries can cause the Optimizer to enter a pathological state, consuming CPU, memory, or internal locking resources beyond designed bounds until the process hangs or crashes. The affected CPE is cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:* with confirmed scope limited to the 9.0.0-9.6.0 release line, meaning older long-term-support branches (8.x) are not affected per Oracle's disclosure. The Red Hat tag suggests downstream packaging for RHEL/CentOS variants may also require updates.

RemediationAI

Apply the Oracle Critical Patch Update released April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses this vulnerability for MySQL Server in the 9.x line. The advisory does not specify an exact fixed version number in the available data, so confirm the minimum safe version from the Oracle CPU patch matrix before upgrading. If immediate patching is not feasible, restrict database login privileges to the minimum required set of users and remove any unused or overly broad accounts that could be leveraged for exploitation; this directly addresses the PR:L prerequisite. Additionally, consider enabling MySQL's connection throttling and max-execution-time settings (max_execution_time, wait_timeout) to limit the impact of runaway Optimizer queries. For externally reachable MySQL instances, enforce network-layer access controls to permit only trusted application hosts. Note that these compensating controls reduce exploitation opportunity but do not eliminate the underlying resource consumption flaw.