Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Vulnerability in the Oracle MySQL Server and MySQL Cluster components allows a high‑privileged attacker with network access to cause a hang or repeatable crash, resulting in a complete denial of service. The weakness stems from improper handling of certain network protocols, leading to resource exhaustion or related failures. The CVSS 3.1 base score of 4.9 indicates a moderate impact on availability, with no confidentiality or integrity compromise.

Affected Systems

Affected are Oracle MySQL Server versions 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, and 26.7.0 to 26.7.1, as well as Oracle MySQL Cluster versions 8.0.0 to 8.0.49, 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, and 26.7.0 to 26.7.1. All configurations that expose the network protocols listed in the advisory are vulnerable.

Risk and Exploitability

The CVSS score of 4.9 highlights a moderate severity for availability, while the EPSS score of 0.0044 (indicating a very low probability of public exploitation) suggests limited publicly known exploitation data. The vulnerability is not listed in CISA KEV and is likely exploitable by attackers who can establish a high‑privilege connection over the network using one of the supported protocols. Successful exploitation directly results in a denial of service, disrupting database availability for the affected system.

Generated by OpenCVE AI on October 23, 2026 at 05:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a MySQL Server or MySQL Cluster release that includes the fix, as detailed in Oracle CPU October 2026 advisories
  • Configure resource limits such as max_connections, query cache size, and connection timeout to prevent resource exhaustion
  • Restrict or disable unnecessary MySQL network protocols (e.g., X Protocol) in the server configuration to limit the attack surface

Generated by OpenCVE AI on October 23, 2026 at 05:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via High‑Privilege Network Access in MySQL Server and Cluster mysql: mysql: Denial of Service in Server Components Services
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Title Denial of Service via High‑Privilege Network Access in MySQL Server and Cluster
Weaknesses CWE-400
CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T17:46:40.260Z

Reserved: 2026-09-28T15:40:09.502Z

Link: CVE-2026-101721

cve-icon Vulnrichment

Updated: 2026-10-22T17:43:24.223Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:26.840

Modified: 2026-10-22T18:17:15.930

Link: CVE-2026-101721

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:22:30Z

Links: CVE-2026-101721 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:00:13Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-400

    Uncontrolled Resource Consumption