MySQL Server CVE-2026-34308

Exploitation requires a valid MySQL database account with at least basic connection and query-execution privileges - corresponding to PR:L in the CVSS vector. The attacker must be able to reach the MySQL Server over a network-accessible protocol (TCP/IP port 3306 by default, or configured alternatives) and execute JSON-related SQL operations against the vulnerable JSON component. No user interaction is required and no race condition or special timing is involved (UI:N, AC:L). Exploitation is strictly limited by the credential requirement: unauthenticated network access alone is insufficient. Environments where database credentials are tightly controlled, issued only to trusted internal systems, and where JSON query capabilities are not granted to external-facing or shared accounts have meaningfully reduced exposure beyond what the CVSS score alone suggests.

The CVSS 3.1 score of 6.5 Medium is internally consistent with an availability-only, authenticated network DoS: the PR:L requirement meaningfully constrains the exploitable population compared to unauthenticated flaws. SSVC reinforces this with 'Automatable: no' - mass exploitation analogous to a worm is not feasible because valid credentials are required - and 'Technical Impact: partial,' which maps to A:H with no C or I impact. EPSS at 0.04% (12th percentile) aligns with SSVC's 'Exploitation: none,' indicating negligible near-term exploitation probability. No CISA KEV listing and no known public POC further reduce urgency. The realistic risk is highest in multi-tenant database environments, SaaS platforms with shared MySQL instances, or deployments where untrusted or external-facing application accounts have query-level access. For tightly controlled deployments with only trusted internal users, the effective risk is low despite the network-accessible vector. No conflicting signals exist between CVSS, EPSS, and SSVC for this CVE.

An authenticated low-privilege database user - such as a shared application service account, a reporting user, or a compromised developer credential - connects to a MySQL Server instance over the network and submits a specially crafted SQL statement invoking JSON functions or targeting JSON columns in a way that triggers uncontrolled resource consumption. The server process hangs or crashes, interrupting service for all concurrent connections and applications depending on that MySQL instance. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) indicates that once the triggering query pattern is identified, exploitation would require no specialized skill beyond a valid login.