Mysql Server

Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Denial of service in Oracle MySQL Server and MySQL Cluster's JSON component allows a low-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the low attack complexity and low privilege requirement make it straightforward to trigger once database credentials are obtained.

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server via the GIS (Geographic Information System) component. Oracle confirmed this in the July 2026 Critical Patch Update with a CVSS 3.1 score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.

Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.

Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.

Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.

Local denial-of-service in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker with OS-level logon access to the host infrastructure to crash or hang the database service via a flaw in the Replication component. Affected versions span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle classifies this as easily exploitable; no public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires physical or logical host-level access rather than remote network reachability.

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-connected attacker to repeatedly hang or crash the database server by exploiting a flaw in the JSON component. The vulnerability requires only a valid MySQL login and network access over any supported protocol, making it trivially reachable in multi-tenant or cloud-hosted environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege threshold elevate practical risk above what the moderate CVSS score of 6.5 might suggest.

Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit flaw in the Server: Replication component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Despite a moderate CVSS base score of 6.4, the impact triad is complete (C:H/I:H/A:H), meaning successful exploitation grants an attacker full control over data confidentiality, integrity, and service availability. No public exploit code exists and no confirmed active exploitation has been identified at time of analysis, with exploitation gated by local infrastructure access and high privilege requirements.

Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-accessible attacker to crash or hang the database server by exploiting a flaw in the Optimizer component. The attack requires only valid database credentials and can be executed via multiple supported protocols (e.g., classic MySQL protocol, X Protocol), with no additional user interaction or elevated permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but Oracle's own language - 'easily exploitable' - and the CVSS AC:L rating indicate low barrier to triggering the condition once credentials are obtained.

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.

Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1 are vulnerable to a network-reachable denial-of-service condition in the query Optimizer component, exploitable by any low-privileged authenticated user. A successful attack causes a complete, repeatable hang or crash of the database server process, disrupting all connected clients. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.

Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.

Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.

Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.

Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.

Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.

Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through a local, high-complexity vulnerability in the Clone Plugin component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation requires an attacker with high privileges and local logon access to the host infrastructure where MySQL executes, under difficult-to-achieve conditions, limiting realistic risk despite the full confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this via the July 2026 Critical Patch Update.

Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.

Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.

Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.

Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: Group Replication Plugin, where a local attacker holding only a logon to the host running the database can compromise the instance without any database credentials. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and carries a CVSS 3.1 base score of 8.4 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

MySQL Server and MySQL Cluster's Optimizer component can be crashed or hung by a high-privileged attacker with network access, resulting in complete denial of service. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making real-world exploitation contingent on access to high-privileged database credentials.

Denial of service in Oracle MySQL Server and MySQL Cluster allows any low-privileged authenticated attacker with network access to hang or repeatably crash the database service by exploiting a flaw in the Optimizer component. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and minimal privilege requirement make this a credible availability risk for any deployment with externally or internally accessible database accounts.

Denial-of-service vulnerability in Oracle MySQL Server and MySQL Cluster's InnoDB storage engine component allows high-privileged network-authenticated attackers to cause a complete, frequently repeatable crash or hang of the database server. Affected deployments span MySQL Server 8.4.x and 9.7.x, as well as MySQL Cluster 8.0.x through 9.7.x, making this a broad cross-version exposure within Oracle's primary database products. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high privilege requirement substantially narrows the real-world attacker population.

Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause repeated crashes or indefinite hangs across affected 8.0, 8.4, and 9.7 release branches. Exploitation is straightforward (AC:L) but gated entirely by the requirement for high database privileges, substantially narrowing the realistic threat population. No public exploit identified at time of analysis and no CISA KEV listing; risk is most acute in replication-dependent high-availability clusters where availability SLAs are critical.

Denial-of-service in Oracle MySQL Server and MySQL Cluster's Optimizer component allows a high-privileged, network-connected attacker to crash or hang the database server. Affected products span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the high privilege and high complexity requirements materially constrain real-world risk.

Denial-of-service in Oracle MySQL Server and MySQL Cluster versions 9.7.0-9.7.1 allows a high-privileged, network-adjacent attacker to repeatedly hang or crash the InnoDB storage engine via multiple supported protocols. The CVSS 3.1 score of 4.9 reflects the PR:H prerequisite, which significantly limits the exploitable population to authenticated database administrators or equivalently privileged accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Denial-of-service in Oracle MySQL Server and MySQL Cluster's DDL component allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash under difficult-to-reproduce conditions. Affected product lines span MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x through 9.7.x, as confirmed in Oracle's July 2026 Critical Patch Update (EUVD-2026-46462). No public exploit or confirmed active exploitation has been identified at time of analysis.

Remote unauthenticated denial-of-service in Oracle MySQL Server and MySQL Cluster (8.0.x, 8.4.x, and 9.0.0-9.7.0) allows network attackers to trigger a hang or repeatable crash of the database via the Server Connection Handling component. Oracle rates the issue as easily exploitable over multiple protocols with no authentication or user interaction, producing a complete availability loss (CVSS 7.5, A:H only). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Denial-of-service in MySQL Server's Optimizer component allows a high-privileged network attacker to hang or repeatedly crash the database engine across three major release branches (8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0). Exploitation requires a high-privilege database account (DBA-level), but once authenticated, the attack is low-complexity and requires no user interaction - Oracle's advisory describes it as 'easily exploitable' in that context. No public exploit code or active exploitation has been identified; EPSS of 0.04% (11th percentile) and SSVC exploitation rating of 'none' together indicate this poses negligible real-world exploitation risk at time of analysis.

Denial-of-service exposure in Oracle MySQL Server's DML (Data Manipulation Language) component allows a high-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server. Affected across three active release trains - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - the vulnerability is exploitable over multiple network protocols without user interaction. No public exploit exists and the vulnerability is not listed in CISA KEV; EPSS at 0.04% (11th percentile) confirms very low exploitation activity at time of analysis.

Denial-of-service in MySQL Server's InnoDB component allows a high-privileged authenticated attacker with network access to cause a hang or frequently repeatable crash of the database server across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Impact is confined to availability - no data exfiltration or integrity compromise is possible through this vector. No public exploit has been identified at time of analysis, and EPSS probability of 0.04% (11th percentile) is consistent with SSVC's confirmed zero observed exploitation, placing this firmly in the lower-priority patch tier for most organizations.

Denial-of-service in MySQL Server's InnoDB storage engine allows a high-privileged, network-authenticated attacker to hang or repeatedly crash the database server across all major release trains (8.0.x, 8.4.x, and 9.x). The vulnerability is reachable over multiple network protocols without user interaction, making it exploitable by any account holding high database privileges (e.g., DBA or SUPER). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, consistent with an EPSS score of just 0.04%.

InnoDB component in MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0 exposes a denial-of-service condition reachable over the network by a highly privileged attacker, causing the database server to hang or crash repeatably. Disclosed as part of Oracle's April 2026 Critical Patch Update (CVSS 3.1: 4.9), the vulnerability has an EPSS of 0.04% (11th percentile), SSVC exploitation status of 'none', and no public exploit identified at time of analysis. Oracle has released a patch; risk is largely limited to scenarios involving compromised administrative credentials or malicious insiders.

Denial-of-service in Oracle MySQL Server's GIS (Geographic Information System) component allows a high-privileged, network-authenticated attacker to cause the database server to hang or repeatedly crash. Versions 9.0.0 through 9.6.0 are confirmed affected. No public exploit has been identified and EPSS probability stands at 0.04% (11th percentile), consistent with SSVC's exploitation rating of 'none' - real-world risk is confined primarily to insider threat or compromised DBA account scenarios.

Denial-of-service in Oracle MySQL Server's Partition component (versions 9.0.0-9.6.0) allows a high-privileged, network-connected attacker to cause a complete server hang or repeatable crash, resulting in full availability loss. Exploitation is constrained to authenticated users holding high database privileges (CVSS PR:H), sharply limiting the realistic attack surface. No public exploit code exists, EPSS is 0.04% (11th percentile), and SSVC confirms no known exploitation - placing this firmly in the low real-world priority tier despite its network-accessible vector.

Denial-of-service in Oracle MySQL Server's JSON component allows authenticated low-privileged network users to hang or repeatedly crash the database server across all three supported release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted JSON-related queries exhaust server resources without adequate bounds checking. No public exploit code or active exploitation has been identified; EPSS of 0.04% at the 12th percentile and SSVC 'Exploitation: none' together confirm this is not under active threat at time of analysis.

Denial-of-service in MySQL Server's InnoDB component allows high-privileged authenticated attackers with network access to crash or hang the database server via multiple protocols. Affected versions span three major release lines - 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 - covering a broad footprint of Oracle MySQL deployments including downstream Red Hat and SUSE packages. Proof-of-concept exploit code exists per SSVC classification, though EPSS stands at 0.04% (11th percentile) with no CISA KEV listing, indicating low observed exploitation probability consistent with the high-privilege prerequisite.

Denial of service in Oracle MySQL Server's Optimizer component allows a low-privileged authenticated attacker with network access to crash or hang the database server across three major version branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The attack is network-reachable over multiple protocols but requires valid database credentials, limiting the exposed surface to authenticated users. No public exploit code exists and EPSS probability sits at 0.04% (12th percentile), making this a meaningful patch-cycle priority rather than an emergency response item, though availability impact for business-critical databases warrants timely remediation.

MySQL Server versions 8.0.0 through 8.0.45 expose a denial-of-service condition in the DML processing component, enabling a highly privileged, network-authenticated attacker to crash or hang the database server. Oracle patched this in the April 2026 Critical Patch Update; no active exploitation has been observed (EPSS 0.04%, 11th percentile; SSVC exploitation: none). The mandatory high-privilege authentication requirement significantly constrains the realistic attacker pool to insiders or post-compromise scenarios.

MySQL Server's Optimizer component, across all 8.0.x releases from 8.0.0 through 8.0.45, is susceptible to uncontrolled resource consumption (CWE-400) that allows a high-privileged, network-authenticated attacker to cause a complete denial of service via server hang or repeatable crash. Oracle disclosed this in the April 2026 Critical Patch Update and has released a fix; no active exploitation has been identified (EPSS 0.04%, CISA SSVC exploitation: none). The combination of a required PR:H attack and availability-only impact considerably reduces real-world urgency compared to the network-vector framing alone.

Uncontrolled resource consumption in the Group Replication Plugin of Oracle MySQL Server (versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0) allows a low-privileged network attacker to hang or repeatedly crash the database server, resulting in complete denial of service. Oracle patched this issue in the April 2026 Critical Patch Update; no active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.04% (12th percentile) reflects very low current exploitation probability. Downstream distribution advisories from Red Hat and SUSE indicate broad ecosystem acknowledgement of the issue.

MySQL Server's Optimizer component in versions 9.0.0 through 9.6.0 is susceptible to uncontrolled resource consumption triggered by a low-privileged authenticated attacker over the network, resulting in a complete denial of service via hang or repeated crash. The attack surface spans multiple protocols and requires no user interaction beyond valid database credentials. No public exploit code has been identified and exploitation probability is minimal (EPSS 0.04%, SSVC exploitation: none), but the low complexity and broad version range make it relevant for any organization running MySQL 9.x in multi-tenant or externally reachable deployments.

Uncontrolled resource consumption in Oracle MySQL Server's Group Replication Plugin allows a low-privileged authenticated network attacker to cause a complete denial of service - server hang or repeatable crash - across three major release lines (8.0.x, 8.4.x, and 9.x). The vulnerability carries a CVSS 3.1 score of 6.5 with network attack vector and low attack complexity, though real-world exploitation pressure is minimal: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation status as none and the attack as non-automatable, and no public exploit code has been identified at time of analysis. Oracle has released a patch via the April 2026 Critical Patch Update.

Uncontrolled resource consumption in the MySQL Server Group Replication Plugin enables low-privileged, network-accessible attackers to cause a complete denial of service - forcing MySQL Server into a hang or repeatedly reproducible crash across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Oracle has released a patch via its April 2026 Critical Patch Update, and no active exploitation has been identified at time of analysis. EPSS stands at 0.04% (12th percentile) and SSVC classifies exploitation as 'none' and the attack as non-automatable, indicating low real-world exploitation probability despite a medium CVSS score.

Uncontrolled resource consumption in the Optimizer component of MySQL Server 8.0.0 through 8.0.45 enables a high-privileged, network-connected attacker to cause a complete denial of service via a hang or repeatable crash. The impact is availability-only - no confidentiality or integrity risk exists - and the CVSS vector (PR:H) confirms exploitation is gated behind high-level database credentials. Oracle addressed this in the April 2026 Critical Patch Update; no active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.04% (11th percentile) reflects minimal observed exploitation probability.

MySQL Server's Optimizer component allows a low-privileged, network-connected attacker to repeatedly crash or hang the database server across three active release trains. Affected versions span 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0, representing a wide swath of currently deployed MySQL installations. Oracle confirmed a patch in the April 2026 Critical Patch Update; no public exploit code exists and EPSS remains at 0.04% with SSVC exploitation status of none, though the breadth of affected versions and low attack complexity make patching a meaningful operational priority for any network-accessible deployment.

Information disclosure in Oracle MySQL Server's Information Schema component exposes a subset of server data to authenticated low-privileged network attackers across three major release branches (8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0). The flaw is exploitable via multiple protocols with low attack complexity but requires a valid database account, limiting opportunistic mass exploitation. No public exploit exists and this vulnerability is absent from the CISA KEV catalog; an EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation pressure.

MySQL Server's Optimizer component allows any low-privileged authenticated user with network access to trigger a complete denial of service via an uncontrolled resource consumption flaw. Affected across three active release lines - 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0 - this vulnerability is broadly deployed given MySQL's ubiquity, but real-world exploitation risk is low: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation as 'none' and the attack as non-automatable, and no public exploit code exists at time of analysis. Oracle released a patch in the April 2026 Critical Patch Update.

MySQL Server's Optimizer component crashes or hangs when high-privileged authenticated attackers submit crafted SQL queries over the network, affecting all active release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The uncontrolled resource consumption (CWE-400) results in complete availability loss for the database service, though confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and EPSS at 0.04% (11th percentile) places this among the lowest-exploitation-probability CVEs, consistent with the SSVC determination of no active exploitation.

Denial of service in MySQL Server's InnoDB component allows a high-privileged, network-connected attacker to cause the server to hang or crash repeatedly, achieving complete availability disruption. All three active release branches are affected: 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and CISA SSVC confirms no active exploitation - placing this firmly in a patch-and-monitor posture rather than emergency response.

Uncontrolled resource consumption in the MySQL Server Optimizer component allows a high-privileged, network-accessible attacker to cause a complete denial of service across all three actively maintained release trains (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The Oracle April 2026 CPU addresses this flaw; no public exploit code is identified and EPSS stands at 0.04% (11th percentile), reflecting low real-world exploitation probability. The scope extends to MySQL Server packages distributed by Red Hat and SUSE, broadening the patching surface for enterprise Linux environments.

Information disclosure in Oracle MySQL Server's Information Schema component allows high-privileged remote attackers to read an unauthorized subset of MySQL Server data across three major version lines. Affected are versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. No public exploit code exists, EPSS exploitation probability sits at 0.03% (7th percentile), and CISA has not added this to KEV - all signals converge on this being a low-priority, low-severity finding appropriate for routine patch cycle treatment.

Denial-of-service in MySQL Server's Optimizer component allows high-privileged, network-authenticated attackers to cause a complete crash or hang across three active release trains (8.0.x, 8.4.x, 9.x). The broad version coverage and multi-protocol attack surface are notable, but the PR:H requirement limits the attacker pool to actors who already hold elevated MySQL credentials. No public exploit has been identified and EPSS at 0.04% (11th percentile) confirms low observed exploitation probability; Oracle has released a patch via the April 2026 Critical Patch Update.

Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 6.5).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 6.5 MEDIUM]

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. [CVSS 6.5 MEDIUM]

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. [CVSS 4.9 MEDIUM]

Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).

Mysql Cluster contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 4.9).

Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 5.3).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Rated medium severity (CVSS 4.0). No vendor patch available.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.