What is the CVSS score of CVE-2026-60311?

CVE-2026-60311 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

MySQL Server CVE-2026-60311

EUVD-2026-46726 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-3qq6-4gg6-4h74

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable via standard MySQL protocols with only low-privilege credentials required; impact is strictly and completely availability with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:04 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.0.0-9.7.1; MySQL Cluster: 9.0.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1 are vulnerable to a network-reachable denial-of-service condition in the query Optimizer component, exploitable by any low-privileged authenticated user. A successful attack causes a complete, repeatable hang or crash of the database server process, disrupting all connected clients. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the MySQL Server Optimizer - the subsystem responsible for query planning, cost estimation, and execution path selection for SQL statements in both MySQL Server and MySQL Cluster. Affected products are identified by CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster, spanning the full 9.x series from 9.0.0 to 9.7.1. No CWE identifier was assigned, leaving the precise root cause class unspecified; the crash or hang pattern is consistent with an unhandled edge case in optimizer logic such as an infinite loop, null dereference, or unguarded assertion during query plan evaluation. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the flaw is reachable over any supported MySQL network protocol - including TCP/IP and X Protocol - by any valid, low-privileged database session.

RemediationAI

Consult and apply the patch issued in Oracle's Critical Patch Update for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number was not specified in the available data - the CPU advisory must be consulted directly to identify the patched MySQL Server and MySQL Cluster release. If immediate patching is not possible, restrict database user grants to the minimum necessary and audit all low-privileged accounts that have network access to the MySQL instance, as any such account can trigger the flaw. Enforcing network perimeter controls to limit MySQL port access (default TCP/3306 and TCP/33060 for X Protocol) to known application hosts reduces the pool of potential exploiters, though it does not address the underlying vulnerability. MySQL's max_execution_time or wait_timeout settings may partially limit the duration of a hang-based DoS but will not prevent initial exploitation. These compensating controls carry trade-offs: overly aggressive connection or query timeouts may interfere with legitimate long-running analytical queries.