What is the CVSS score of CVE-2026-60324?

CVE-2026-60324 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

MySQL Server CVE-2026-60324

EUVD-2026-46739 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-64hm-xqj2-52q2

Denial Of Service Oracle Mysql Server Mysql Cluster Red Hat

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible Optimizer flaw requires only valid low-privilege credentials (PR:L); no confidentiality or integrity impact; availability fully compromised on trigger.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:02 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-accessible attacker to crash or hang the database server by exploiting a flaw in the Optimizer component. The attack requires only valid database credentials and can be executed via multiple supported protocols (e.g., classic MySQL protocol, X Protocol), with no additional user interaction or elevated permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but Oracle's own language - 'easily exploitable' - and the CVSS AC:L rating indicate low barrier to triggering the condition once credentials are obtained.

Technical ContextAI

The vulnerability resides in the Server: Optimizer component of Oracle MySQL, which is responsible for parsing, transforming, and generating execution plans for SQL queries. A crafted query or sequence of queries can cause the optimizer to enter a hang state or trigger a repeatable crash, resulting in complete availability loss for all connected clients. Affected products are identified by CPE strings cpe:2.3:a:oracle_corporation:mysql_server and cpe:2.3:a:oracle_corporation:mysql_cluster, both constrained to versions 9.7.0 and 9.7.1. No CWE has been assigned by Oracle or NVD, which limits root-cause classification; common optimizer-layer failure classes include improper input validation (CWE-20), uncontrolled resource consumption (CWE-400), or reachable assertion/NULL dereference (CWE-617/CWE-476). The multi-protocol attack surface (AV:N) means the flaw is reachable via any network-exposed MySQL listener.

RemediationAI

Apply the patch provided in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version is not independently specified in the available intelligence data - consult the CPU advisory directly for the target upgrade version. As an interim compensating control, restrict database network exposure to trusted application servers using firewall rules or MySQL's bind-address configuration to reduce the set of clients that can send optimizer-triggering queries; note this does not eliminate risk if application accounts are compromised. Revoking unnecessary privileges from application-tier accounts (limiting to only required DML/DDL operations rather than arbitrary query execution) may reduce exposure, though the low-privilege threshold means most application accounts will still qualify. Enabling MySQL's connection throttling or max_execution_time variable to abort long-running queries can limit the hang scenario but may introduce latency for legitimate workloads.