Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (availability)
Action: Patch immediately
AI Analysis

Impact

The vulnerability lies in the GIS component of the MySQL Server and MySQL Cluster products. A low‑privileged attacker who can reach the database over the network can send specially crafted requests via supported protocols. This causes the server engine to hang or crash, resulting in a complete denial of service for all users of that instance. The flaw is a medium‑severity issue with a CVSS 3.1 base score of 6.5 and a vector highlighting only availability impact. The vulnerability aligns with CWE‑284 (Improper Access Control), and CWE‑617 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Affected Systems

Oracle MySQL Server and MySQL Cluster versions 26.7.0 through 26.7.1 contain the flaw. Both the standalone server and the clustered deployment are affected, as the code path is shared by the GIS component across these products.

Risk and Exploitability

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been observed. The CVSS base score is 6.5, indicating moderate severity. Nonetheless, the attack can be performed over the network by an unauthenticated or low‑privileged attacker with only modest effort, making it a viable target for automated intrusion attempts. The impact is limited to availability, but a successful exploit would bring database services to a halt, disrupting dependent applications.

Generated by OpenCVE AI on October 23, 2026 at 06:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle MySQL security patch or upgrade to a non‑affected release for MySQL 26.7.x.
  • Restrict inbound traffic to the MySQL port (default 3306) to trusted IP addresses or subnet ranges using firewall rules or network ACLs.
  • Monitor MySQL server logs for repeated crash or hang events that may indicate exploitation attempts, and alert on anomalous traffic patterns.

Generated by OpenCVE AI on October 23, 2026 at 06:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title MySQL Server and Cluster GIS Denial of Service Vulnerability mysql: mysql: Denial of Service in Server GIS component
Weaknesses CWE-617
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title MySQL Server and Cluster GIS Denial of Service Vulnerability
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T17:33:00.746Z

Reserved: 2026-09-28T15:40:09.503Z

Link: CVE-2026-101743

cve-icon Vulnrichment

Updated: 2026-10-22T17:26:04.577Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:29.313

Modified: 2026-10-28T18:53:41.967

Link: CVE-2026-101743

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:22:38Z

Links: CVE-2026-101743 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:30:07Z

Weaknesses