EUVD-2026-106028
GHSA-6q9g-jx3g-c9vj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged MySQL credentials
-
ExploitConnect over network protocol
-
ExecutionSubmit crafted query triggering Optimizer flaw
-
ImpactServer hangs or crashes (complete DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged MySQL account (PR:L) with network reachability to the database over any supported protocol; exploitation targets the Server: Optimizer component via crafted queries. The attack is 'easily exploitable' per Oracle (AC:L) and needs no user interaction (UI:N), but the authentication requirement is the key limiting factor - fully anonymous/unauthenticated exploitation is NOT possible. Exploitation is limited to the affected innovation releases MySQL Server/Cluster 9.7.0 through 9.7.3; LTS lines and other versions are not listed as affected. Impact is restricted to denial of service (hang/crash); no data exposure or modification results. |
| Impact | This is a moderate-severity availability-only vulnerability (CVSS 3.1 base 6.5, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) in the MySQL Server/Cluster Optimizer component. The signals are internally consistent: network-reachable (AV:N), low attack complexity (AC:L), but requiring an authenticated low-privileged account (PR:L) and causing only an availability impact (A:H) - a hang or repeatable crash (complete DoS) with no confidentiality or integrity loss. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a real patch-management priority for availability-sensitive database deployments but is NOT a drop-everything emergency: the PR:L authentication barrier and pure-DoS impact meaningfully limit real-world risk compared to a critical RCE. Note that CVE-2026-101620 and the referenced Oracle CPU (cpuoct2026.html) are dated beyond this analysis's knowledge horizon, so details rely solely on the provided Oracle/NVD/EUVD metadata and could not be independently cross-verified. No SSVC decision data or CWE classification was supplied. |
| Exploit ScenarioDerived | An attacker holding any low-privileged MySQL account (e.g., a limited application or reporting user) connects over the network via a supported protocol and submits a specially crafted query that the Optimizer mishandles, driving the server into a hang or repeatable crash. Repeating the request produces a complete denial of service for all database clients. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0 through 9.7.3 allows an authenticated low-privileged attacker with network access to crash or hang the database via crafted queries against the Server: Optimizer component. Oracle rates the issue as easily exploitable (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
RemediationAI
Apply the fix from the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); the advisory is the authoritative source for the exact patched MySQL Server/Cluster 9.7.x release, as no precise fix version was provided in the input data. Until patching is possible, restrict network access to MySQL listener ports to trusted application hosts, enforce least-privilege account management because exploitation requires a valid low-privileged account, and monitor for unusual repeated crashes or hangs that could indicate attempted exploitation. These controls reduce exposure but do not eliminate the flaw, and tightening network ACLs may disrupt legitimate clients.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Oracle MySQL's Server: Optimizer component, which parses and plans SQL statements. A low-privileged user who can authenticate over the network can submit specially crafted queries that force the optimizer into a state leading to a hang or repeatable crash of the MySQL server process. The CVSS vector confirms network reachability (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and availability-only impact (A:H), with no confidentiality or integrity effect. Per EUVD, only the 9.7 innovation release line (MySQL Server and MySQL Cluster 9.7.0-9.7.3) is affected; no CWE was assigned, and no CPE strings were included in the input. The root cause class is not formally specified (CWE: N/A); the observable effect is a denial of service in query optimization.
Know when MySQL gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable (AV:N) and easily exploitable (AC:L) but requires an authenticated low-privileged DB account (PR:L); impact is availability-only DoS (A:H), no C/I.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3; MySQL Cluster: 9.7.0-9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Rated high severity
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
HUSTOJ online judge has a path traversal vulnerability enabling arbitrary file access on the competition server.
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
Exploit-DB