MySQL Server CVE-2026-34278

The CVSS vector PR:H confirms that the attacker must possess high database privileges - equivalent to a DBA or SUPER-privileged MySQL account - before any exploitation is possible. The attack is delivered over the network via any MySQL-supported protocol (TCP/IP, etc.), so no local shell access is required, but the privilege prerequisite is a significant real-world barrier. The vulnerability is specific to the Optimizer component, meaning the trigger is a SQL query that exercises the query plan generation path in a way that exhausts resources. No non-default configuration flags are cited as conditions. What limits exploitation: (1) PR:H is the primary constraint - most external or low-trust users will not hold these privileges; (2) SSVC rates it non-automatable, meaning mass scanning/exploitation is not viable; (3) only MySQL 8.0.x is affected, not 5.7 or 9.x branches.

Despite a network attack vector (AV:N), real-world risk is constrained by the PR:H requirement - an attacker must already hold high database privileges before exploitation is possible. CVSS base score of 4.9 reflects this accurately. EPSS at 0.04% (11th percentile) places this firmly in the bottom tier of exploitation likelihood; no public exploit code has been identified. SSVC signals reinforce this: exploitation status is 'none', the attack is not automatable (non-default attacker preconditions), and technical impact is rated only 'partial'. The CIA triad is C:N/I:N/A:H, meaning there is zero confidentiality or integrity risk - only availability. In practice, this represents a concern primarily in multi-tenant database environments or SaaS platforms where customers may hold high-privilege roles and could abuse them to disrupt service for others. For organizations where only fully trusted administrators hold elevated MySQL privileges, risk is negligible.

A database user with DBA-level or equivalent high privileges submits a pathologically crafted SQL query designed to trigger an edge case in the MySQL Optimizer's plan-enumeration logic, consuming server resources without bound until the mysqld process hangs or crashes. An attacker in a shared hosting or multi-tenant SaaS database environment who legitimately holds a high-privilege role could use this to deny service to other tenants. No public proof-of-concept exists at time of analysis.