Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Availability)
Action: Assess Impact
AI Analysis

Impact

A vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster can be exploited by a high privileged attacker with network access. The flaw allows the attacker to induce a server hang or complete crash that repeatedly restarts services, effectively denying availability of the affected database system. This issue represents a broken access control weakness (CWE-284) and a resource exhaustion denial of service flaw (CWE-400). The impact is limited to availability; there is no disclosed compromise of confidentiality or integrity from the available information.

Affected Systems

Oracle MySQL Server versions 8.4.0‑8.4.12, 9.7.0‑9.7.3, and 26.7.0‑26.7.1; MySQL Cluster versions 8.0.0‑8.0.49, 8.4.0‑8.4.12, 9.7.0‑9.7.3, and 26.7.0‑26.7.1 are listed as affected. All affected instances expose multiple network protocols used for replication, which provide the necessary attack surface.

Risk and Exploitability

The CVSS score of 4.9 indicates a moderate risk level. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), the attacker only needs network access and elevated privileges, which are often present in database administrators or compromised local users. Successful exploitation results in a denial of service that could disrupt business processes reliant on the database cluster or server.

Generated by OpenCVE AI on October 23, 2026 at 01:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle’s October 2026 CPU for a patch or upgrade to a later MySQL version that excludes the affected release range.
  • Apply network segmentation or firewall rules to restrict replication traffic to known trusted hosts and limit exposure of replication ports.
  • Configure resource limits and timeout settings on the MySQL server to prevent indefinite hangs or frequent restarts due to replication failures.

Generated by OpenCVE AI on October 23, 2026 at 01:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title DoS Vulnerability in MySQL Server and Cluster via Replication Component mysql: mysql: Denial of Service via the Server Replication component
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title DoS Vulnerability in MySQL Server and Cluster via Replication Component
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T17:45:46.189Z

Reserved: 2026-09-28T15:40:09.502Z

Link: CVE-2026-101729

cve-icon Vulnrichment

Updated: 2026-10-22T17:43:37.222Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:27.733

Modified: 2026-10-22T18:17:16.913

Link: CVE-2026-101729

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:22:33Z

Links: CVE-2026-101729 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T02:00:16Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-400

    Uncontrolled Resource Consumption