Skip to main content

MySQL Server EUVDEUVD-2026-24395

| CVE-2026-34303 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-04-21 oracle
Denial Of Service Oracle Mysql Server Oracle Corporation
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network-accessible optimizer flaw exploitable by any authenticated low-privilege user; impact is strictly availability with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Jul 24, 2026 - 06:15 vuln.today
EUVD ID Assigned
Apr 21, 2026 - 21:01 euvd
EUVD-2026-24395
CVE Published
Apr 21, 2026 - 20:35 nvd
MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle MySQL Server's Optimizer component allows a low-privileged authenticated attacker with network access to crash or hang the database server across three major version branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The attack is network-reachable over multiple protocols but requires valid database credentials, limiting the exposed surface to authenticated users. No public exploit code exists and EPSS probability sits at 0.04% (12th percentile), making this a meaningful patch-cycle priority rather than an emergency response item, though availability impact for business-critical databases warrants timely remediation.

Technical ContextAI

MySQL Server's Optimizer is the subsystem that parses, plans, and selects execution strategies for SQL queries. CWE-400 (Uncontrolled Resource Consumption) indicates that a specially crafted query can force the optimizer into an abnormal resource consumption state - most likely an exponential-complexity plan evaluation loop, unbounded memory growth, or a tight CPU spin - ultimately causing the server process to hang or crash. This class of defect typically arises from edge cases in join reordering, subquery flattening, or cost-model estimation that produce runaway internal recursion or allocation. The CPE (cpe:2.3:a:oracle_corporation:mysql_server:*:*:*:*:*:*:*:*) spans all Oracle MySQL Server installations, and the fact that all three active version branches (8.0.x, 8.4.x, and 9.x) are affected points to a defect residing in shared optimizer code rather than a version-specific regression. Distribution tags for Red Hat and SUSE indicate the vulnerability propagates to downstream Linux distribution packages.

RemediationAI

The primary fix is to apply Oracle's patch released as part of the April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Exact patched version numbers for the 8.0.x, 8.4.x, and 9.x branches are not independently confirmed in the available data - consult the CPU advisory directly for the precise upgrade targets within each branch. Red Hat and SUSE customers should additionally check their respective security errata for distribution-specific updated packages. If immediate patching is not feasible, restrict database network access so that only trusted application service accounts can connect, and audit all MySQL user accounts to revoke query execution rights from any account that does not operationally require them; note this may require application-level changes. Deploying a database activity monitor or query firewall to detect and rate-limit unusually complex or resource-intensive queries is a viable compensating control, though it adds operational overhead and may generate false positives on legitimate analytical workloads.

More in Mysql Server

View all
CVE-2019-5436 HIGH POC
7.8 May 28

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4

CVE-2021-21344 CRITICAL POC
9.8 Mar 23

XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2019-3822 CRITICAL POC
9.8 Feb 06

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. Rated critical severity (
CVE-2021-22945 CRITICAL POC
9.1 Sep 23

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
CVE-2021-21351 CRITICAL POC
9.1 Mar 23

XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
CVE-2022-27778 HIGH POC
8.1 Jun 02

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2021-22926 HIGH POC
7.5 Aug 05

libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS
CVE-2021-22946 HIGH POC
7.5 Sep 29

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FT
CVE-2019-5482 CRITICAL
9.8 Sep 16

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Rated critical severity (CVSS 9.8), this vul
CVE-2019-10219 MEDIUM POC
6.1 Nov 08

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
CVE-2021-22922 MEDIUM POC
6.5 Aug 05

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

EUVD-2026-24395 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy