What is the CVSS score of CVE-2026-34304?

CVE-2026-34304 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34304?

Yes, a patch is available for CVE-2026-34304. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-34304

EUVD-2026-24397 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 oracle

GHSA-g74q-22gc-6974

Denial Of Service Oracle Mysql Server Oracle Corporation

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable InnoDB flaw requires high-privilege credentials; pure availability-only DoS with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:15 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24397

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server's InnoDB component allows high-privileged authenticated attackers with network access to crash or hang the database server via multiple protocols. Affected versions span three major release lines - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - covering a broad footprint of Oracle MySQL deployments including downstream Red Hat and SUSE packages. Proof-of-concept exploit code exists per SSVC classification, though EPSS stands at 0.04% (11th percentile) with no CISA KEV listing, indicating low observed exploitation probability consistent with the high-privilege prerequisite.

Technical ContextAI

The vulnerability resides in InnoDB, MySQL Server's default transactional storage engine, and is classified under CWE-400 (Uncontrolled Resource Consumption). This root-cause class indicates that a specially crafted database operation can exhaust a bounded resource - such as memory buffers, internal locks, or engine threads - causing InnoDB to hang or crash rather than recover gracefully. The attack surface is reachable over multiple MySQL network protocols (e.g., the classic MySQL wire protocol on port 3306 and the X Protocol on 33060), as confirmed by the CVSS AV:N metric. Affected CPE is cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:*, encompassing the three release branches called out by EUVD-2026-24397.

RemediationAI

Apply the patch issued as part of Oracle's April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html; exact fixed version numbers were not independently confirmed in the available data, so consult the advisory directly to identify the minimum safe version for your specific release line (8.0.x, 8.4.x, or 9.x). Administrators running Red Hat- or SUSE-packaged MySQL should apply the corresponding downstream security updates from those vendors rather than the Oracle upstream advisory. As a compensating control where immediate patching is not feasible, enforce the principle of least privilege by auditing and revoking unnecessary high-privilege grants (SUPER, SYSTEM_VARIABLES_ADMIN) from application accounts - this directly targets the PR:H prerequisite and is the highest-value mitigation; note that this may affect applications relying on dynamic variable changes or replication configuration. Additionally, restrict network-level access to MySQL ports (3306, 33060) using host-based firewalls or network ACLs to limit which hosts can initiate privileged sessions, though this does not protect against insider threats or already-compromised administrative accounts.