The vulnerability resides in the Optimizer component of both MySQL Server and MySQL Cluster. An attacker who has high privileged access and can reach the server over the network can trigger a series of poorly handled refinement steps that cause the database engine to hang or crash repeatedly. This results in a complete denial of service because the affected instances become unresponsive and require manual or automated restarts to recover. The weakness can be classified as an authorization failure (CWE-284) and a resource exhaustion or input handling flaw (CWE-400).

Oracle MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, as well as Oracle MySQL Cluster versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1 are affected. The flaw is present in the Server: Optimizer component across all these product lines.

The CVSS 3.1 base score of 4.9 reflects a moderate severity focused on availability and is evaluated using a network access vector with high privilege required. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no public evidence of widespread exploitation at the time of assessment. Nevertheless, environments where administrative credentials are exposed or where audit and monitoring controls are weak face the greatest risk, as an attacker able to authenticate with the required privileges can repeatedly trigger server crashes that may exhaust system resources and disrupt services.