A flaw in the Optimizer component of Oracle MySQL Server and MySQL Cluster can be exploited by a high‑privileged attacker who has network access. By sending specially crafted input over multiple protocols the attacker can trigger a crash or hang of the database engine, resulting in a complete denial of service. The vulnerability is scored CVSS 3.1 Base Score 4.9, indicating a moderate severity rating that primarily affects availability and does not compromise confidentiality or integrity.

Oracle MySQL Server and Oracle MySQL Cluster are impacted. For MySQL Server the affected releases are 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. For MySQL Cluster the same version ranges apply: 8.0.0–8.0.49, 8.4.0–8.4.12, 9.7.0–9.7.3, and 26.7.0–26.7.1. Users operating any of these releases should verify that the database is not running a vulnerable version of the optimizer component.

The CVSS score of 4.9 indicates the threat poses a moderate risk; however, the exploit is considered easily exploitable once the attacker has high network privileges, as it requires no user interaction and can be launched remotely via any protocol that the database accepts. No known public exploit is available and the vulnerability is not listed in CISA’s KEV catalog. Because EPSS data is unavailable, there is no quantified estimate of current exploitation likelihood, but the moderate CVSS and high privilege requirement suggest monitoring for suspicious activity is prudent.