MySQL Connector/C++ CVE-2026-60180

Exploitation requires the vulnerable Connector/C++ (versions 9.7.0-9.7.1) to process attacker-influenced network traffic over one of the supported MySQL protocols - per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed once that traffic reaches the connector. The primary limiting factor is the attack surface: as a client library, the connector must be induced to communicate with a malicious or compromised server or have crafted packets injected into an existing connection, and only versions 9.7.0 and 9.7.1 are affected. Impact is limited to availability (crash/hang) with no path to data access or code execution, and the exact protocol-level trigger is not detailed in the source, so the precise deployment configuration that exposes the flaw should be confirmed with Oracle's advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) reflects easy, unauthenticated, remote exploitation but with impact strictly limited to availability - there is no data disclosure or code execution. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation-probability signals are absent; the risk is therefore driven by the CVSS profile alone. In practice this is a meaningful but bounded issue: a HIGH score inflated by A:H should not be equated with a system-compromise vulnerability. Because Connector/C++ is a client library, the realistic threat model requires the connector to process attacker-influenced traffic (e.g., connecting to a malicious or compromised MySQL server, or a MITM on the connection), which tempers the raw AV:N reading - the description says multiple protocols but does not clarify whether a rogue server or a client-facing listener is the trigger; verify the exact attack surface with Oracle. Absent KEV/EPSS/POC data, treat as a standard patch-cycle DoS priority rather than an emergency.

An attacker who controls or can impersonate a MySQL endpoint (or otherwise inject crafted protocol traffic on the connection) sends a malformed response to an application built on Connector/C++ 9.7.0/9.7.1, driving the connector into an infinite hang or repeatable crash and taking the dependent application offline. Given AC:L and PR:N, no authentication or complex setup is required once the attacker can reach the connector's traffic, and repeating the trigger sustains a complete denial of service. No public proof-of-concept was identified in the provided data.