What is the CVSS score of CVE-2026-47008?

CVE-2026-47008 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

MySQL Server CVE-2026-47008

EUVD-2026-46497 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-54f7-p954-gxw6

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-accessible DoS requiring high-privilege credentials; no confidentiality or integrity impact, and scope is unchanged within the database instance.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:38 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected component is InnoDB, the default transactional storage engine embedded in MySQL Server and MySQL Cluster. InnoDB handles row-level locking, ACID transactions, and crash recovery - a hang or crash in this component effectively takes the entire database instance offline. Affected products are identified via CPE as cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster, both narrowed to versions 9.7.0-9.7.1. The CWE is listed as N/A, meaning Oracle has not disclosed the specific root-cause class (e.g., null pointer dereference, assertion failure, unbounded loop), which is common for Oracle CPU disclosures. The vulnerability is accessible over multiple protocols, consistent with MySQL's support for TCP/IP, Unix socket, and named pipe transports.

RemediationAI

Apply the patch provided in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact fixed version number is not independently confirmed in the provided data beyond Oracle's CPU advisory; consult the advisory directly to determine the target upgrade version. As a compensating control, restrict database port access (default TCP 3306 and 33060) to only trusted application servers and authorized administrator hosts via firewall rules or MySQL's bind-address directive - this reduces the attack surface to internal trusted principals even if the vulnerability cannot be patched immediately. Additionally, audit and minimize the number of accounts holding high-privileged roles (SUPER, SYSTEM_VARIABLES_ADMIN, etc.) to limit who can trigger the flaw. Note that restricting network access does not eliminate risk from insider threats or compromised internal systems.