What is the CVSS score of CVE-2026-34317?

CVE-2026-34317 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

MySQL Shell CVE-2026-34317

EUVD-2026-24416 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-04-21 oracle

GHSA-qhr7-4g47-87m7

Denial Of Service Oracle Mysql Shell Oracle Corporation

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.0 MEDIUM

Local-only vector with low-privilege requirement and mandatory human interaction confirmed by description; impact is strictly availability via crash or hang of the shell process.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:10 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24416

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.0

DescriptionCVE.org

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Shell executes to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Shell. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Shell's Core Client component allows a low-privileged local attacker, with required human interaction from another user, to cause a hang or repeatable crash of MySQL Shell across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit has been identified, EPSS sits at 0.01% (2nd percentile), and SSVC assesses exploitation as 'none' with non-automatable attack conditions - all signals converging on minimal real-world risk. Impact is strictly limited to availability; there is no confidentiality or integrity exposure.

Technical ContextAI

MySQL Shell is Oracle's advanced command-line client and scripting interface for MySQL, supporting SQL, JavaScript, and Python modes and widely used for database administration and DevOps automation. The affected component is the Core Client, which handles session lifecycle, resource management, and interactive shell processing. CWE-404 (Improper Resource Shutdown or Release) identifies the root cause class: the shell fails to properly release or shut down an internal resource - likely a file descriptor, socket handle, memory allocation, or IPC object - under certain conditions triggered by user interaction. This class of flaw typically manifests when error or edge-case code paths skip cleanup routines, leaving the process in a hung or unstable state. The CPE string (cpe:2.3:a:oracle_corporation:mysql_shell) confirms the vulnerability is in the MySQL Shell application layer, not in the underlying MySQL server daemon or client library.

RemediationAI

The primary remediation is to apply the patch provided in the Oracle Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Exact patched version numbers are not specified in the available intelligence data; administrators should consult the Oracle CPU directly to identify the target upgrade version for their 8.0.x, 8.4.x, or 9.x branch. Patch available per vendor advisory. As a compensating control in environments where immediate patching is not feasible, restricting interactive MySQL Shell access to trusted users only (via OS-level access controls) reduces the attack surface, since exploitation requires both a low-privileged local account and human interaction from another user. Given the DoS-only impact and low EPSS score, this vulnerability is not a high-urgency emergency patch but should be included in the next regular maintenance cycle.