The vulnerability is in the JSON processing component of MySQL Server and MySQL Cluster, allowing a low‑privileged attacker with network access to send malformed JSON data that causes the system to hang or repeatedly crash. This leads to a complete denial of service for that database instance, preventing accepted connections until a restart succeeds. The flaw stems from improper input validation and resource exhaustion, reflected in CWE-20 and CWE-400.

The flaw affects Oracle MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. MySQL Cluster is vulnerable for component versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. These releases are all publicly available, and many production environments rely on them for mission‑critical database services.

The CVSS v3.1 base score of 6.5 indicates moderate severity with a high impact on availability. The EPSS score is less than 1%, suggesting a low but nonzero probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Because the attacker only needs low privileges and network access to an exposed MySQL port or other supported protocol, the attack path is straightforward for an adversary on the same network or with compromised credentials. In environments lacking strict segmentation or firewall controls, repeated attempts could exhaust resources and result in long‑term service outages.