CVE-2026-101612 - Vulnerability Details

- mysql: mysql: Denial of Service in InnoDB component

Description

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H).

Published: 2026-10-20

Score: 4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the InnoDB component of Oracle MySQL Server and MySQL Cluster allows a high‑privileged local user who has already logged into the host to repeatedly force the database service to hang or crash. The vulnerability requires human interaction from a person other than the attacker while the attacker is still present on the infrastructure, and results in a complete denial of service by terminating or suspending the database process. The weakness corresponds to CWE‑400 and CWE‑617.

Affected Systems

Affected products are Oracle MySQL Server and Oracle MySQL Cluster. For MySQL Server, the vulnerable builds are 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. For MySQL Cluster, the affected releases are 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1.

Risk and Exploitability

The base CVSS score is 4.0, indicating a low severity availability impact. The EPSS score is below 1 %, suggesting a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user with high privileges who has previously logged into the host and a second user to provide human interaction, making a pure remote attack unlikely. The likely attack vector is local, with limited practical threat unless an adversary has foothold and sufficient access in the environment. The weakness involves CWE‑400 and CWE‑617.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

MySQL Server

affected

Version	Status	Constraints
`8.4.0-8.4.12`	affected	—
`9.7.0-9.7.3`	affected	—
`26.7.0-26.7.1`	affected	—

Oracle Corporation

MySQL Cluster

affected

Version	Status	Constraints
`8.0.0-8.0.49`	affected	—
`8.4.0-8.4.12`	affected	—
`9.7.0-9.7.3`	affected	—
`26.7.0-26.7.1`	affected	—

No data.

Vendor Product Confidence Versions

Oracle

Mysql Cluster

100%

Version	Status	Scheme	Platform
`[8.0.0,8.0.49]`	affected	semver	—
`[8.4.0,8.4.12]`	affected	semver	—
`[9.7.0,9.7.3]`	affected	semver	—
`[26.7.0,26.7.1]`	affected	semver	—

Oracle

Mysql Server

100%

Version	Status	Scheme	Platform
`[8.4.0,8.4.12]`	affected	semver	—
`[9.7.0,9.7.3]`	affected	semver	—
`[26.7.0,26.7.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the patch or upgrade to a MySQL Server or MySQL Cluster release newer than the highest affected version listed in Oracle’s October 2026 security advisory.
Limit local account privileges to the minimum required for running the database services, enforcing a strict principle of least privilege for all users able to log on to the host.
Implement monitoring of database uptime, crash logs, and automatic restart or high‑availability configurations to minimize downtime impact.

Generated by OpenCVE AI on November 5, 2026 at 20:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00113.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-101612
https://www.cve.org/CVERecord?id=CVE-2026-101612
https://www.oracle.com/security-alerts/cpuoct2026.html

History

Thu, 05 Nov 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 23 Oct 2026 07:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-400 CWE-665

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Title	Denial of Service Vulnerability in MySQL InnoDB	mysql: mysql: Denial of Service in InnoDB component
Weaknesses		CWE-617
References		https://nvd.nist.gov/vuln/detail/CVE-2026-101612 https://www.cve.org/CVERecord?id=CVE-2026-101612
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 21 Oct 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title		Denial of Service Vulnerability in MySQL InnoDB
Weaknesses		CWE-400 CWE-665

Tue, 20 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H).
First Time appeared		Oracle Oracle mysql Cluster Oracle mysql Server
CPEs		cpe:2.3:a:oracle:mysql_cluster:::::::: cpe:2.3:a:oracle:mysql_server::::::::
Vendors & Products		Oracle Oracle mysql Cluster Oracle mysql Server
References		https://www.oracle.com/security-alerts/cpuoct2026.html
Metrics		cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H'}`

Subscriptions

Oracle Mysql Cluster Mysql Server

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2026-10-20T21:21:53.070Z

Updated: 2026-11-05T16:07:14.627Z

Reserved: 2026-09-28T15:40:09.495Z

Link: CVE-2026-101612

Vulnrichment

Updated: 2026-11-05T15:57:10.598Z

NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:14.993

Modified: 2026-11-05T17:17:31.390

Link: CVE-2026-101612

Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:21:53Z

Links: CVE-2026-101612 - Bugzilla

OpenCVE Enrichment

Updated: 2026-11-05T20:30:16Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object