What is the CVSS score of CVE-2026-60174?

CVE-2026-60174 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

MySQL Server CVE-2026-60174

EUVD-2026-46580 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-297q-x8q4-rp55

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable optimizer flaw requiring only a valid low-privilege account; impact is availability-only (DoS), with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:20 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.

Technical ContextAI

The affected component is MySQL's Server Optimizer - the subsystem responsible for parsing, planning, and executing SQL query execution plans. Both the standard MySQL Server and the high-availability MySQL Cluster product share the same Optimizer code path, as reflected by CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster for versions 9.7.0-9.7.1. A flaw in how the Optimizer processes certain inputs can be triggered remotely via multiple supported protocols (e.g., MySQL native protocol, X Protocol), causing the server process to hang indefinitely or crash. Oracle did not assign a CWE, so the exact root cause class (e.g., improper input validation, infinite loop, divide-by-zero) is unspecified in available data. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the Optimizer flaw is reachable over the network with minimal preconditions.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number (e.g., 9.7.2) is not independently confirmed in the available data; consult the Oracle CPU directly for the precise target release. As a compensating control where immediate patching is not feasible, restrict network access to MySQL listener ports (default TCP 3306, X Protocol TCP 33060) to only trusted internal IP ranges using firewall rules or MySQL's bind-address configuration - this reduces but does not eliminate risk if untrusted low-privileged users already hold valid credentials. Additionally, review and revoke unnecessary low-privileged database accounts, as the vulnerability requires at minimum a valid database login. Note that restricting network access may impact application availability; account-level controls have no performance side effects.