What is the CVSS score of CVE-2026-47012?

CVE-2026-47012 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-47012?

Yes, a patch is available for CVE-2026-47012. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-47012

EUVD-2026-46501 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-hg2w-fhgp-x8r7

Denial Of Service Oracle Red Hat Mysql Cluster Mysql Server Suse Oracle Corporation

4.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Network vector confirmed via multi-protocol access; PR:H and AC:H match Oracle's 'difficult to exploit, high privileged' characterization; availability-only impact as solely DoS is possible.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:40 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.4

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.

Technical ContextAI

The vulnerable component is the Server: Optimizer subsystem of Oracle MySQL - the internal engine responsible for parsing, planning, and optimizing SQL query execution paths. A flaw in this subsystem can be triggered via crafted input delivered over any MySQL-supported network protocol (e.g., MySQL Wire Protocol on TCP/3306, X Protocol on TCP/33060), ultimately causing an uncontrolled hang or repeatable crash. Oracle's CPE identifiers (cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster) confirm that both the standalone server and the clustered distributed variant share this code path. No CWE was assigned by Oracle, so the exact root cause class - whether a logic error, improper input validation, or resource exhaustion - cannot be confirmed from available data.

RemediationAI

Patch via Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact minimum safe (patched) version numbers are not enumerated in the available intelligence data and must be confirmed directly from the Oracle CPU advisory table - consult it for the specific fix versions applicable to your MySQL Server or MySQL Cluster branch. As compensating controls while patching, restrict network access to MySQL ports (default 3306/TCP for classic protocol, 33060/TCP for X Protocol) to the minimum set of trusted administrative hosts using firewall rules or MySQL's bind-address configuration; note this trades administrative flexibility for reduced attack surface. Additionally, audit and reduce the set of accounts holding high-privilege grants, as the vulnerability is only reachable by high-privileged users (PR:H). These mitigations reduce the pool of potential attackers but do not eliminate the underlying flaw.