EUVD-2026-46593
GHSA-pcvf-6mq8-j65f
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Network vector confirmed by multi-protocol access; AC:H and PR:H reflect replication-context conditions and required admin credentials; only availability impacted with no data exposure.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Technical ContextAI
MySQL's Replication component manages binary log-based data synchronization between primary and replica instances over multiple protocols including standard TCP/IP MySQL protocol and replication-specific channels. The CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster confirm both the server and cluster product lines are within scope across multiple version branches (8.0.x, 8.4.x, 9.7.x). No CWE identifier is assigned in available intelligence, precluding formal root-cause class categorization from public data alone; Oracle's description classifies this only as a Denial of Service flaw within the replication subsystem. The multi-protocol attack surface (AV:N) suggests the flaw may be triggerable through standard MySQL client connections or via dedicated replication channel traffic. The CVSS High Attack Complexity (AC:H) metric implies the attacker must satisfy non-standard preconditions - such as a specific server state, race condition, or replication topology requirement - beyond simply having credentials.
RemediationAI
The primary remediation is to apply the patches released as part of Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact fixed version numbers are not independently stated in the available intelligence and must be confirmed directly from that advisory before deployment. As a compensating control prior to patching, organizations should restrict network-level access to MySQL replication ports (default 3306, or custom replication ports) to only trusted replica host IP addresses using firewall rules or MySQL's bind-address configuration - this directly raises the bar for the AV:N attack path without disabling functionality. Additionally, auditing and minimizing the set of accounts granted REPLICATION SLAVE, REPLICATION CLIENT, and SUPER privileges reduces the effective pool of accounts meeting the PR:H prerequisite; removing unused replication accounts is zero-impact and immediately effective. Disabling replication entirely would eliminate this specific attack surface but would disrupt high-availability and disaster recovery architectures and carries significant operational trade-offs. Patch application during a scheduled maintenance window is the preferred resolution.
More in Mysql Server
View allA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. Rated critical severity (
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FT
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Rated critical severity (CVSS 9.8), this vul
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today