What is the CVSS score of CVE-2026-34278?

CVE-2026-34278 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34278?

Yes, a patch is available for CVE-2026-34278. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-34278

EUVD-2026-24354 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-fh86-xhc3-24gr

Denial Of Service Oracle Mysql Server

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable optimizer flaw requires high database privileges; impact is purely availability via crash or hang, with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:25 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24354

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server's Optimizer component, across all 8.0.x releases from 8.0.0 through 8.0.45, is susceptible to uncontrolled resource consumption (CWE-400) that allows a high-privileged, network-authenticated attacker to cause a complete denial of service via server hang or repeatable crash. Oracle disclosed this in the April 2026 Critical Patch Update and has released a fix; no active exploitation has been identified (EPSS 0.04%, CISA SSVC exploitation: none). The combination of a required PR:H attack and availability-only impact considerably reduces real-world urgency compared to the network-vector framing alone.

Technical ContextAI

The MySQL Server Optimizer is responsible for generating and evaluating query execution plans for SQL statements. CWE-400 (Uncontrolled Resource Consumption) indicates that a specially crafted query can exhaust server-side resources - CPU cycles, memory, or internal state - within the optimizer's plan-generation path, causing a hang or crash without any bounds check or resource ceiling being enforced. The vulnerability is reachable via any supported MySQL network protocol (TCP/IP, named pipes, etc.), meaning an attacker does not need local shell access. The affected CPE is cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:*, covering the entire 8.0 branch from 8.0.0 to 8.0.45. Distribution tags (Red Hat, SUSE) indicate that downstream packaged versions of MySQL 8.0 in those ecosystems are also in scope.

RemediationAI

The primary fix is to upgrade MySQL Server to version 8.0.46 or later, which is the release immediately following the stated upper bound of 8.0.45; Oracle confirms a patch is available via the April 2026 CPU at https://www.oracle.com/security-alerts/cpuapr2026.html. Red Hat and SUSE users should apply the respective distribution-provided updated MySQL 8.0 packages through their standard package managers (yum/dnf or zypper) once available in the vendor security channels. As a compensating control where immediate patching is not feasible, restrict the SUPER, CREATE, ALTER, and EXECUTE privileges to only explicitly trusted operator accounts, since PR:H exploitation requires a high-privilege session - revoking unnecessary elevated grants reduces the attack surface at the cost of operational flexibility. Additionally, consider enabling connection-level resource limits (MAX_QUERIES_PER_HOUR, MAX_CONNECTIONS_PER_HOUR) on high-privilege accounts to throttle any abuse attempt, though this does not fully prevent the crash condition.