What is the CVSS score of CVE-2026-61108?

CVE-2026-61108 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

MySQL Server CVE-2026-61108

EUVD-2026-47319 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-x5mp-fcpp-cg54

Oracle Denial Of Service Mysql Server Mysql Cluster Red Hat

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable GIS component exploitable by any authenticated low-privilege user with no complexity; pure availability impact, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server via the GIS (Geographic Information System) component. Oracle confirmed this in the July 2026 Critical Patch Update with a CVSS 3.1 score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in MySQL's Server: GIS component, which implements spatial and geographic data types and functions (e.g., ST_* functions, geometry processing) per ISO/IEC 13249-3 SQL/MM Spatial standards. MySQL Server and MySQL Cluster share this codebase path, explaining why both product lines are simultaneously affected at the same version range (9.7.0-9.7.1). The CWE is listed as N/A, meaning Oracle has not disclosed the specific root-cause class - possibilities consistent with a DoS in a GIS parser include input validation flaws (CWE-20), uncontrolled resource consumption (CWE-400), or infinite loops (CWE-835), but none of these can be confirmed from available data. The CVSS vector (AV:N/AC:L/PR:L) confirms the flaw is reachable over the network via multiple MySQL-supported protocols (TCP/IP, X Protocol, etc.) by any authenticated low-privilege user.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. No exact patched version number was disclosed in the available data beyond the advisory reference; consult Oracle's advisory directly to identify the specific target release. As a compensating control while patching, restrict GIS/spatial function access by revoking permissions on spatial data types and ST_* functions from untrusted or low-privilege database accounts using REVOKE statements - note this may break legitimate spatial queries. Additionally, enforcing strict network-level access controls (firewall rules, VPC segmentation) to limit MySQL port exposure to trusted application servers reduces the attack surface without functional impact. For MySQL Cluster deployments, the same patch cycle applies to all cluster nodes simultaneously.