MySQL Shell CVE-2026-34319

MySQL Shell is Oracle's primary interactive client for MySQL, supporting JavaScript, Python, and SQL modes, and widely used for DevAPI scripting, InnoDB Cluster administration, and database migrations. The affected component is Shell: Core Client - the foundational input-processing and session-management layer. CWE-204 (Observable Response Discrepancy) indicates the shell produces detectably distinct behavioral responses to varying inputs, a condition the attacker exploits to drive execution into a crash or infinite-hang path. This root cause class is unusual for a pure DoS - it typically implies the shell's response to a crafted input diverges from its normal path in an observable and reproducible way, likely in input parsing or command dispatch. The CPE string cpe:2.3:a:oracle_corporation:mysql_shell applies across all three affected major version lines. The local attack vector (AV:L) strictly confines this to attackers with OS-level logon access to the host running MySQL Shell.