EUVD-2026-46730
GHSA-47wc-32xv-3x4v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Unauthenticated low-complexity network attack on the X Plugin gives PR:N/AC:L/AV:N; impact is complete DoS (A:H) with only partial data read (C:L) and no integrity effect (I:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
AnalysisAI
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the MySQL X Plugin be enabled and its X Protocol listener (default TCP 33060) be network-reachable by the attacker - this is the exact component named in the CVE. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are moderately consistent and point to a genuine priority for internet- or network-exposed MySQL X Protocol endpoints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the MySQL X Protocol port (33060) sends crafted X Plugin protocol messages without any credentials, driving the server into a hang or repeatable crash and taking the database completely offline, while also reading a limited subset of accessible data. Because attack complexity is low and no authentication or user interaction is required, this can be scripted against exposed instances; no public POC has been identified at time of analysis. |
| Remediation | Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs deliver the fix in the next quarterly release above the affected ranges, so upgrade MySQL Server past 8.4.10 / 9.7.1 and MySQL Cluster past 8.0.47 / 8.4.10 / 9.7.1 to the CPU-patched versions (exact patched build numbers are enumerated in the CPU advisory and should be taken from it rather than assumed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all MySQL Server instances running versions 8.4.0-8.4.10, 9.7.0-9.7.1, or affected MySQL Cluster versions (8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1); disable the X Plugin component if operationally feasible by setting mysqlx=OFF in the MySQL configuration file. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mysql Server
View allA heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. Rated critical severity (
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
libcurl-using applications can ask for a specific client certificate to be used in a transfer. Rated high severity (CVSS
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FT
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Rated critical severity (CVSS 9.8), this vul
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Rated critical severity (CVSS 9.8), this vu
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today