What is the CVSS score of CVE-2026-34276?

CVE-2026-34276 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34276?

Yes, a patch is available for CVE-2026-34276. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-34276

EUVD-2026-24351 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-mwrp-hhpc-x64f

Denial Of Service Oracle Mysql Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Aligns with vendor vector; PR:L reflects required low-privilege credentials, AV:N confirms network reachability, and C/I:N reflects availability-only impact with no data exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:26 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24351

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Uncontrolled resource consumption in the Group Replication Plugin of Oracle MySQL Server (versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0) allows a low-privileged network attacker to hang or repeatedly crash the database server, resulting in complete denial of service. Oracle patched this issue in the April 2026 Critical Patch Update; no active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.04% (12th percentile) reflects very low current exploitation probability. Downstream distribution advisories from Red Hat and SUSE indicate broad ecosystem acknowledgement of the issue.

Technical ContextAI

MySQL Server's Group Replication Plugin provides multi-primary and single-primary clustering capabilities, communicating over standard MySQL protocols (TCP/3306 and related ports) and internal Group Communication System (GCS/Paxos-based) channels. CWE-400 (Uncontrolled Resource Consumption) as the root cause class indicates the plugin fails to impose adequate bounds on resource usage - CPU, memory, or connection state - when processing certain protocol inputs, allowing an attacker to exhaust server resources until the process hangs or crashes. The CPE cpe:2.3:a:oracle_corporation:mysql_server covers the three affected release branches (8.0.x, 8.4.x, 9.x). Group Replication is a separately enabled component; standalone or non-replicated MySQL deployments would not expose this attack surface.

RemediationAI

The primary fix is to upgrade to a patched version of MySQL Server per Oracle's April 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuapr2026.html; the exact first-fixed versions for each branch (8.0.46+, 8.4.9+, 9.6.1+ or later) should be confirmed directly in that advisory, as precise patched version numbers are not independently confirmed in the available data. For Red Hat and SUSE environments, apply the corresponding distribution security errata once published. As a compensating control where immediate patching is not feasible, restrict MySQL port (3306/TCP and any GCS communication ports) access to trusted replication peers and administrative hosts via firewall rules - this reduces the attack surface to already-trusted network segments but does not eliminate the vulnerability. If Group Replication is not actively required on a given instance, disabling the plugin entirely (via removing group_replication from plugin-load and not starting the group) eliminates the affected code path but requires re-enabling and re-initializing replication if clustering is later needed. Audit MySQL user accounts and revoke unnecessary privileges to reduce the pool of accounts that could be leveraged by a low-privileged attacker.