What is the CVSS score of CVE-2026-47052?

CVE-2026-47052 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-47052?

Yes, a patch is available for CVE-2026-47052. Update the affected software to the latest version immediately.

Oracle MySQL CVE-2026-47052

EUVD-2026-46538 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-gjg8-ggw8-pg6h

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat Suse

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable DoS requiring high database privileges; no confidentiality or integrity impact; availability fully compromised on successful exploitation.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:58 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.

Technical ContextAI

InnoDB is Oracle MySQL's default transactional storage engine, responsible for row-level locking, MVCC, crash recovery, and the bulk of SQL workload execution. A flaw in this component means the vulnerability is reachable through standard SQL operations or internal engine routines rather than a peripheral plugin or optional module. The CPE strings (cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster) confirm the issue spans both the standalone MySQL Server product and the distributed MySQL Cluster (NDB) variant. No CWE identifier was assigned by Oracle, which is not uncommon in Oracle CPU advisories where root-cause classification is withheld; the impact description of hang or repeatable crash is consistent with classes such as CWE-400 (Uncontrolled Resource Consumption) or CWE-476 (NULL Pointer Dereference) within an engine-level code path, but this is inferred, not confirmed.

RemediationAI

Apply the patches distributed as part of the Oracle Critical Patch Update (CPU) for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU advisories include exact patched version numbers; consult the advisory directly to identify the specific fixed release for each affected branch (MySQL Server 8.4.x, 9.7.x; MySQL Cluster 8.0.x, 8.4.x, 9.7.x) - no fixed version numbers were independently confirmed in the available intelligence and should not be assumed. As a compensating control, restrict database network access to trusted administrative hosts only and enforce least-privilege principles so that high-privilege database accounts are not exposed to untrusted users. Disabling external network access to the MySQL port (default 3306/3316 for Cluster) reduces the network attack surface, though it does not eliminate risk from internal or lateral-movement scenarios. Oracle does not typically publish standalone workarounds for CPU-class vulnerabilities; patching is the primary remediation.