What is the CVSS score of CVE-2026-61109?

CVE-2026-61109 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-61109?

Yes, a patch is available for CVE-2026-61109. Update the affected software to the latest version immediately.

MySQL Server CVE-2026-61109

EUVD-2026-47320 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-72pw-r4f3-922c

Oracle Denial Of Service Mysql Server Mysql Cluster Red Hat Suse

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable via standard DB protocol, low complexity, requires only a valid low-privilege account; no confidentiality or integrity impact, only availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle MySQL Server and MySQL Cluster's JSON component allows a low-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the low attack complexity and low privilege requirement make it straightforward to trigger once database credentials are obtained.

Technical ContextAI

The vulnerability resides in the Server: JSON component of Oracle MySQL - the subsystem responsible for parsing, validating, and manipulating JSON documents stored in JSON-typed columns or processed via JSON functions (e.g., JSON_EXTRACT, JSON_ARRAY, JSON_OBJECT). Oracle MySQL Server and MySQL Cluster are widely deployed relational database management systems; the Cluster variant adds NDB storage and distributed topology. Affected CPE strings cover mysql:mysql_server (8.4.x, 9.7.x) and mysql:mysql_cluster (8.0.x, 8.4.x, 9.7.x). No CWE was assigned by NVD, but the described behavior - a hang or repeatable crash triggered by a low-complexity network request - is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-20 (Improper Input Validation) within the JSON parsing path. The multi-protocol access vector ('multiple protocols') referenced in the description suggests the flaw is reachable via standard MySQL client protocol (TCP/3306) as well as potentially X Protocol (TCP/33060), broadening the attack surface.

RemediationAI

Apply the patches distributed in Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle fixed binaries; consult the advisory to identify the specific patched version for your MySQL release line (8.4.x or 9.7.x for Server; 8.0.x, 8.4.x, or 9.7.x for Cluster). Exact patched version numbers are not independently confirmed in the available data - cross-reference the CPU matrix before upgrading. As a compensating control where immediate patching is not feasible, restrict database account privileges to the minimum required and audit any accounts with JSON function access; revoking EXECUTE or SELECT on JSON-heavy schemas for non-essential accounts reduces the attacker's ability to trigger the flaw. Additionally, consider enforcing network-level access controls (firewall rules, VPC security groups) to limit which hosts can reach MySQL ports 3306 and 33060, reducing the pool of potential authenticated attackers. Note that privilege restriction does not eliminate the vulnerability for legitimate application accounts - it only raises the bar for external attackers who would need to first compromise credentials.