What is the CVSS score of CVE-2026-60624?

CVE-2026-60624 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

MySQL Connector/J CVE-2026-60624

EUVD-2026-46982 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-07-21 secalert_us@oracle.com

GHSA-6vpc-gw25-q88q

Denial Of Service Oracle Mysql Connectors

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable, low complexity, no privileges needed; UI:R confirmed by description; impact is availability-only with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:00 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Connector/J 9.7.0-9.7.1 allows an unauthenticated remote attacker to crash or indefinitely hang the connector process via multiple protocols, contingent on human interaction from a victim. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), rating it CVSS 6.5. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting risk is currently theoretical rather than actively weaponized.

Technical ContextAI

MySQL Connector/J is Oracle's official Type-4 JDBC driver for connecting Java applications to MySQL database servers, communicating over the MySQL wire protocol (TCP, typically port 3306) as well as potentially other supported transport channels. The affected versions 9.7.0 and 9.7.1 represent recent releases in the 9.x major line. No CWE is assigned in the available data, so the precise root cause class - whether malformed packet parsing, resource exhaustion, infinite loop, or exception mishandling - cannot be confirmed from available intelligence. The AV:N vector confirms the flaw is reachable over the network, and the UI:R flag indicates the connector's crash or hang is triggered only when a victim application or user initiates or processes a connection/response, suggesting a server-to-client attack path where a malicious or compromised MySQL server sends crafted responses to a connecting client.

RemediationAI

Consult the Oracle July 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpujul2026.html for the specific patched release version; the advisory data does not include an explicit fixed version number, so the exact upgrade target should be confirmed from the Oracle CPU release notes before deploying. As a workaround pending patching, consider restricting Connector/J-based applications to connect only to trusted, internally controlled MySQL servers, reducing the surface for a malicious-server attack path implied by the UI:R vector. If the application can tolerate it, implementing connection timeouts and restart-on-crash supervisor logic (e.g., systemd RestartSec, Kubernetes liveness probes) will limit the operational impact of a hang or crash. No compensating control fully eliminates the vulnerability - patching to the Oracle-recommended version remains the definitive fix.