Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Availability
Action: Apply Patch
AI Analysis

Impact

Vulnerability exists in the NDB Operator component of MySQL Cluster version 9.7.3, allowing a low‑privileged attacker with network access via HTTP to trigger a hang or repeated crash, effectively denying service.

Affected Systems

Oracle MySQL Cluster 9.7.3 is affected; other versions are not listed as vulnerable.

Risk and Exploitability

The CVSS base score of 6.5 reflects a moderate severity with a high impact on availability; the EPSS score of 0.00411 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires only network access to the affected endpoint and low privileges, enabling denial of service to the cluster.

Generated by OpenCVE AI on October 22, 2026 at 09:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch for MySQL Cluster 9.7.3 as detailed in the October 2026 security alert
  • Disable or restrict HTTP access to the NDB Operator component if it is not required for business operations
  • Monitor cluster logs and performance metrics for unusual hang or crash patterns that may indicate an attempted denial of service

Generated by OpenCVE AI on October 22, 2026 at 09:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via NDB Operator HTTP in MySQL Cluster 9.7.3

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via NDB Operator HTTP in MySQL Cluster 9.7.3
Weaknesses CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
CPEs cpe:2.3:a:oracle:mysql_cluster:9.7.3:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:36:30.877Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101628

cve-icon Vulnrichment

Updated: 2026-10-21T18:19:36.248Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:16.840

Modified: 2026-10-21T19:16:51.410

Link: CVE-2026-101628

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:30:13Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-770

    Allocation of Resources Without Limits or Throttling