EUVD-2026-24405
GHSA-rwvq-ffmg-g3q5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network exploitation requires a valid low-privilege database credential (PR:L); availability is fully compromised via crash or hang, with no confidentiality or integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Denial-of-service in Oracle MySQL Server's JSON component allows authenticated low-privileged network users to hang or repeatedly crash the database server across all three supported release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted JSON-related queries exhaust server resources without adequate bounds checking. No public exploit code or active exploitation has been identified; EPSS of 0.04% at the 12th percentile and SSVC 'Exploitation: none' together confirm this is not under active threat at time of analysis.
Technical ContextAI
The vulnerability resides in MySQL Server's JSON component - the subsystem responsible for parsing, storing, and processing JSON document types in SQL query execution. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the server does not adequately bound CPU or memory resources when processing certain JSON queries, allowing a crafted input to cause a hang or crash. The CVSS vector AV:N reflects that MySQL's standard protocols (TCP/IP on port 3306, and optionally named pipes or shared memory) expose this component over the network. The unchanged scope (S:U) confirms the impact is contained to the MySQL Server process itself without privilege escalation or lateral spread. CPE cpe:2.3:a:oracle_corporation:mysql_server applies to Oracle's official distribution, and downstream packaging by Red Hat and SUSE (noted in tags) means this reaches Linux enterprise environments through standard package channels.
RemediationAI
The primary remediation is to apply Oracle's patch released as part of the April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Exact fixed version numbers per branch (8.0.x, 8.4.x, 9.x) are not independently listed in the available intelligence data and must be confirmed directly from the Oracle CPU advisory. Red Hat and SUSE customers should apply updated MySQL Server packages through their respective channels (e.g., RHSA advisories, SUSE Security Updates) rather than waiting for a manual Oracle upgrade. As a compensating control prior to patching, restrict low-privilege database accounts to the minimum required permissions and revoke the ability to execute JSON functions or query JSON columns for accounts that do not need them - this reduces exploitable attack surface without eliminating the flaw. Additionally, enforce network-level controls to limit MySQL port 3306 access to trusted application hosts only; note this does not protect against exploitation by already-authenticated internal users but limits opportunistic external access.
More in Mysql Server
View allA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. Rated critical severity (
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FT
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Rated critical severity (CVSS 9.8), this vul
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today