Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Availability
Action: Apply Patch
AI Analysis

Impact

Vulnerability exists in the NDB Operator component of MySQL Cluster version 9.7.3, allowing a low‑privileged attacker with network access via HTTP to trigger a hang or repeated crash, effectively denying service.

Affected Systems

Oracle MySQL Cluster 9.7.3 is affected; other versions are not listed as vulnerable.

Risk and Exploitability

The CVSS base score of 6.5 reflects a moderate severity with a high impact on availability; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate to high likelihood of exploitation in environments where the HTTP interface of the NDB Operator is exposed. Successful exploitation requires only network access to the affected endpoint and low privileges, enabling denial of service to the cluster.

Generated by OpenCVE AI on October 21, 2026 at 00:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch for MySQL Cluster 9.7.3 as detailed in the October 2026 security alert
  • Disable or restrict HTTP access to the NDB Operator component if it is not required for business operations
  • Monitor cluster logs and performance metrics for unusual hang or crash patterns that may indicate an attempted denial of service

Generated by OpenCVE AI on October 21, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via NDB Operator HTTP in MySQL Cluster 9.7.3
Weaknesses CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
CPEs cpe:2.3:a:oracle:mysql_cluster:9.7.3:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:59.063Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101628

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:16.840

Modified: 2026-10-20T22:18:16.840

Link: CVE-2026-101628

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T00:30:12Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling