EUVD-2026-47304
GHSA-c885-7vgw-rp67
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege MySQL credentials
-
DeliveryEstablish network connection to MySQL instance
-
ExploitSubmit specially crafted SQL query
-
ExecutionTrigger Optimizer flaw in query planning
-
PersistMySQL Server crashes or hangs
-
ImpactDatabase availability lost for all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | A valid MySQL database account with low privileges is required (PR:L per Oracle's CVSS vector) - no DBA, SUPER, or administrative role is needed; any authenticated user capable of submitting SQL queries can trigger the flaw. Network access to the MySQL instance via any supported protocol (e.g., classic MySQL protocol on TCP 3306, X Protocol on TCP 33060) must be available. The vulnerability is limited to MySQL Server and MySQL Cluster versions 9.7.0 and 9.7.1 only - deployments on any other version branch are not listed as affected. No non-default configuration setting or specific schema structure is stated as required. Exploitation is limited by the need to possess or compromise a database credential; unauthenticated (PR:N) access cannot trigger this vulnerability. |
| Impact | The Oracle CVSS 3.1 score of 6.5 (Medium) accurately reflects the constrained impact profile: availability-only (C:N/I:N), no scope change, and low privilege requirement. The 'easily exploitable' Oracle classification elevates operational concern because any authenticated database user - including read-only or application service accounts - can trigger the crash, broadening the attacker pool significantly. No EPSS score is present in the available intelligence, so probabilistic likelihood cannot be quantified numerically. No CISA KEV listing and no public exploit code have been identified, indicating this is not currently being exploited at scale. The risk is most acute in multi-tenant database environments, cloud-hosted MySQL instances accessible to multiple users, and deployments where database uptime is business-critical. For environments with strict access controls and a small, trusted user base, the practical risk is considerably lower despite the network-accessible attack vector. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privilege MySQL account - through credential theft, default credentials, or a separate application-layer compromise - connects to the MySQL Server over the network and submits a crafted SQL query designed to trigger a flaw in the Optimizer. The server crashes or enters a hang state, causing a complete denial of service for all connected users and applications. In a MySQL Cluster deployment, repeated crashes of individual nodes could cascade into broader cluster degradation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, detailed at https://www.oracle.com/security-alerts/cpujul2026.html - the exact patched release version is not independently confirmed in available data and must be verified against that advisory before deployment. As an interim compensating control, restrict network access to MySQL ports (default TCP 3306; X Protocol TCP 33060; Cluster management port TCP 1186) to trusted application subnets using host-based or network firewall rules, reducing the pool of users who can submit queries. Note that overly broad firewall restrictions may disrupt legitimate application connectivity and must be tested. Additionally, audit and minimize database accounts: revoke unnecessary login privileges for service accounts that do not require query execution against the affected Optimizer-heavy workloads. These controls reduce exposure but do not eliminate the vulnerability - patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in MySQL's Server: Optimizer component - the subsystem responsible for query execution planning, cost estimation, and query rewriting before execution. MySQL Cluster extends this into a distributed, shared-nothing architecture across multiple data nodes, making Optimizer-level crashes potentially more disruptive. Oracle's CVSS vector (AV:N/AC:L/PR:L) indicates exploitation via standard MySQL protocols such as TCP/IP (default port 3306) or the X Protocol. The root cause class (CWE) was not disclosed by Oracle, but availability-only crashes in query optimizers typically stem from null dereferences, divide-by-zero conditions, or infinite loops triggered by specially crafted query constructs. The scope remains unchanged (S:U), indicating the crash is contained within the MySQL process rather than escaping to the host OS.
Know when Mysql Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
PR:L reflects the required low-privilege database account; AV:N and AC:L are appropriate for network-accessible query submission; C:N/I:N because impact is DoS only.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mysql Server
View allIn order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. Rated high severity (C
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. Rated critical severity (
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FT
Exploit-DB