What is the CVSS score of CVE-2026-34293?

CVE-2026-34293 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34293?

Yes, a patch is available for CVE-2026-34293. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-34293

EUVD-2026-24378 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-42m9-g5m6-v663

Denial Of Service Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable DoS requiring high-privilege MySQL credentials; strictly availability impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:19 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24378

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server versions 8.0.0 through 8.0.45 expose a denial-of-service condition in the DML processing component, enabling a highly privileged, network-authenticated attacker to crash or hang the database server. Oracle patched this in the April 2026 Critical Patch Update; no active exploitation has been observed (EPSS 0.04%, 11th percentile; SSVC exploitation: none). The mandatory high-privilege authentication requirement significantly constrains the realistic attacker pool to insiders or post-compromise scenarios.

Technical ContextAI

The affected component is MySQL Server's Data Manipulation Language (DML) engine - the subsystem responsible for processing INSERT, UPDATE, DELETE, and SELECT statements. The root cause class is CWE-400 (Uncontrolled Resource Consumption), meaning a crafted or malformed DML operation can cause the server to consume unbounded CPU or memory until it hangs or crashes. The affected CPE is cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:* covering the 8.0.x branch through 8.0.45. MySQL's multi-protocol architecture (TCP/IP, named pipes, shared memory, Unix sockets) means the flaw is reachable via any supported connection method, consistent with the CVSS AV:N (network) vector. Downstream Linux distribution packages from Red Hat and SUSE are also affected, widening the patching surface beyond Oracle's own distribution.

RemediationAI

Apply Oracle's patch released in the April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html); the advisory should be consulted to confirm the exact fixed version number, as the precise patched release (e.g., 8.0.46 or later) is not explicitly stated in available intelligence data. Red Hat and SUSE users should apply updated MySQL packages via their respective distribution errata channels as soon as they become available. As an interim compensating control, restrict network access to the MySQL port (default 3306/TCP) to only trusted administrative hosts using firewall rules or MySQL's bind-address configuration - this does not eliminate the vulnerability but reduces the network attack surface. Additionally, audit and minimize the number of accounts holding HIGH-privilege MySQL roles, as the PR:H requirement means that reducing privileged account exposure directly reduces exploitability. If the environment allows it, limiting MySQL to Unix socket connections for local-only deployments removes the network vector entirely. None of these controls substitute for patching.