What is the CVSS score of CVE-2026-61128?

CVE-2026-61128 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

MySQL Server CVE-2026-61128

EUVD-2026-47337 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-qmg7-g4m8-vj22

Oracle Denial Of Service Mysql Server Mysql Cluster Red Hat

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

PR:H reflects the confirmed high-privilege requirement; A:H captures the complete crash/hang impact; C:N and I:N are appropriate as no data exfiltration or modification is involved.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in MySQL's Server Optimizer component - the internal subsystem responsible for parsing, planning, and selecting efficient execution paths for SQL queries. Optimizer-class defects commonly involve improper handling of edge-case query constructs such as deeply nested subqueries, specific JOIN or window-function patterns, or internal data structure mismanagement (e.g., null pointer dereferences, unbounded recursion in query plan trees, or integer overflows in cost estimation). Both MySQL Server and MySQL Cluster products share this affected component in versions 9.7.0 and 9.7.1. The vulnerability is reachable over any MySQL-supported network protocol (TCP/IP being the most common, but also MySQL X Protocol), meaning it does not require physical or local access. Oracle has not assigned a CWE, so the precise root-cause class remains unconfirmed from available data. The ENISA EUVD tracking identifier is EUVD-2026-47337.

RemediationAI

The primary remediation is to apply the patch released by Oracle as part of the July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the exact fixed version number was not specified in available source data, so administrators should consult the CPU advisory directly to identify the correct target release for MySQL 9.7.x. As a compensating control, enforce strict least-privilege on MySQL accounts: revoke or restrict the SUPER privilege and equivalent administrative roles (SYSTEM_VARIABLES_ADMIN, RELOAD, PROCESS) to only the minimum set of trusted administrator accounts, since exploitation requires high-privileged access. Additionally, enforce network-level access controls - firewall rules or VPC security groups - that restrict MySQL port 3306 (and X Protocol port 33060) to authorized management hosts only, reducing exposure even for authenticated high-privilege users. Note that restricting network access does not eliminate risk if a privileged insider or compromised admin account is the threat actor. Cluster environments should apply the patch to all cluster nodes simultaneously to avoid split availability states during rolling upgrades.