What is the CVSS score of CVE-2026-61144?

CVE-2026-61144 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

MySQL Server CVE-2026-61144

EUVD-2026-47352 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-mmq9-mcpx-q295

Oracle Denial Of Service Mysql Server Mysql Cluster Red Hat

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Network-reachable optimizer crash requires high-privilege DB credentials; availability-only impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:19 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 4.9

DescriptionCVE.org

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Technical ContextAI

The affected component is the Server: Optimizer - the subsystem responsible for parsing, analyzing, and generating execution plans for SQL queries in MySQL Server and MySQL Cluster. A logic or resource-handling defect within this component allows a specifically crafted query to cause the server process to hang or crash. CWE classification is listed as N/A by the reporter; however, the crash/hang behavior in a query optimizer is consistent with root cause classes such as unchecked resource consumption (CWE-400), improper input validation (CWE-20), or an unreachable loop exit condition (CWE-835) - none of these are vendor-confirmed. Oracle notes the attack is achievable via 'multiple protocols,' consistent with MySQL's support for TCP/IP, named pipes, and Unix domain sockets. Affected versions are MySQL Server 9.7.0-9.7.1 and MySQL Cluster 9.7.0-9.7.1, a relatively recent release branch in the MySQL 9.x line.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the exact patched version number is not explicitly stated in the available intelligence and has not been independently confirmed - consult Oracle's patch matrix for the specific target version. If immediate patching is not feasible, reduce the population of accounts holding high-privilege MySQL roles to the absolute minimum required for operations, as exploitation is gated entirely on PR:H access. Enforce network-level controls restricting MySQL port access (default TCP 3306) to trusted hosts and administrative networks only, reducing the attack surface to accounts that can physically reach the service. These compensating controls reduce opportunity but do not eliminate the vulnerability; patching remains the only confirmed remediation.