MySQL Connector/J CVE-2026-60624

Human interaction is required - specifically, a legitimate application or user must initiate or process a MySQL connection using Connector/J 9.7.0 or 9.7.1, making this most plausible as a server-to-client attack where a malicious or attacker-controlled MySQL endpoint sends crafted responses. The attacker requires network access to a position where they can respond to connection attempts from the victim connector, either by operating a rogue server or by performing a man-in-the-middle interception on an unencrypted MySQL channel. No authentication by the attacker is required (PR:N confirmed by CVSS vector). Exploitation is limited to the specific version window of 9.7.0 and 9.7.1; Connector/J deployments on any other version are not vulnerable. There is no indication that TLS/SSL enforcement on the MySQL connection would block this attack, since the interaction point may precede or co-occur with the handshake.

The CVSS 3.1 base score of 6.5 (Medium) reflects low attack complexity and no required privileges, offset by the mandatory user interaction (UI:R) and purely availability-only impact (C:N/I:N/A:H). EPSS data is not present in the provided intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no POC is referenced, indicating no confirmed active exploitation at time of analysis. Real-world risk is further bounded by the narrow version window (9.7.0-9.7.1 only), meaning only organizations that specifically upgraded to these two recent patch releases are exposed - earlier 9.x and 8.x deployments are unaffected. The impact is limited to availability of the connector (DoS), with no confidentiality or integrity compromise. For organizations running affected versions as part of high-availability or latency-sensitive Java services connecting to MySQL, the risk warrants prompt patching during the next maintenance window; it is unlikely to justify emergency response absent active exploitation evidence.

An attacker operating a rogue or compromised MySQL server sends a specially crafted protocol response to a Java application using Connector/J 9.7.0 or 9.7.1 when that application initiates a connection. The malformed response triggers a hang or crash within the connector, taking the database connectivity layer of the application offline. No public exploit code has been identified, and the requirement for victim-initiated interaction limits opportunistic mass exploitation.