MySQL Server EUVD-2026-37356

The MySQL Server or MySQL Cluster listener must be reachable by the attacker on at least one of its supported connection-handling protocols (typically TCP 3306 for the classic MySQL protocol, 33060 for X Protocol, or NDB ports 1186 and the data node range for Cluster); Oracle explicitly states 'multiple protocols' are viable vectors. No authentication, no user interaction, and no non-default configuration are required - the affected code path is in pre-auth connection handling, so any process that can complete a TCP handshake to the daemon can trigger it. Limiting factors are purely network-layer: instances that bind only to localhost, are firewalled to specific application hosts, or sit behind a connection proxy that terminates and revalidates the protocol significantly reduce exposure. The affected versions are bounded to MySQL Server 8.4.0-8.4.9 and 9.0.0-9.7.0 and MySQL Cluster 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0; older 8.0.x MySQL Server (non-Cluster) builds are not listed as affected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is internally consistent with Oracle's 'easily exploitable, unauthenticated, over multiple protocols' wording - meaning any host that can reach the MySQL listener can knock the instance over. However, impact is bounded: C:N and I:N mean no data is read or modified, only availability is lost, so this is a service-outage risk rather than a breach risk. No EPSS score, KEV listing, or public PoC was provided, so probability of opportunistic mass exploitation is unverified; given DoS-only impact, real-world targeting tends to be opportunistic against internet-exposed MySQL or targeted against specific tenants. Priority is high for internet-exposed or multi-tenant deployments and moderate for properly firewalled internal databases. Note: CWE is missing and no technical PoC or vendor write-up beyond the CPU advisory is available, so the exact protocol that triggers the crash is not confirmed.

An attacker on the same network segment as a MySQL listener - or anywhere on the internet if the port is exposed - sends a crafted packet sequence over the MySQL classic or X protocol during connection establishment, causing mysqld or ndbd to hang or crash. Repeating the request keeps the database offline, taking down every application that depends on it; no credentials, no user interaction, and no prior foothold are required. No public exploit identified at time of analysis, but the AC:L rating and 'frequently repeatable crash' wording in Oracle's description suggest a reliable single-packet or short-sequence trigger once the bug is reverse-engineered from the patch.