Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The flaw lies in the Security: Encryption component of Oracle MySQL Server and MySQL Cluster. A high‑privileged attacker with network access can trigger the service to hang or crash, causing a denial of service. The weakness corresponds to CWE-284, CWE-617, and CWE-770. As a result, no authentication or user interaction is required once the attacker has elevated privileges, allowing repeated, automatic hangs or crashes.

Affected Systems

Affected customers are users of Oracle MySQL Server and Oracle MySQL Cluster with release numbers 26.7.0 through 26.7.1. These versions are affected for both products. Attackers can reach the vulnerable services over multiple network protocols.

Risk and Exploitability

The CVSS base score is 4.9, indicating a moderate availability impact but limited overall risk. The EPSS score is less than 1%, implying a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because higher privileged network users can trigger a crash without any user interaction, the attack vector is network‑based and privileged. The impact is limited to service downtime, but repeated occurrences can disrupt operations significantly.

Generated by OpenCVE AI on October 23, 2026 at 02:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Oracle MySQL update that addresses this vulnerability
  • Restrict network access to the MySQL Server and Cluster services, allowing connections only from trusted hosts or through a VPN
  • Configure high‑availability or failover clustering to maintain service availability if a crash occurs

Generated by OpenCVE AI on October 23, 2026 at 02:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title MySQL Server and Cluster Denial of Service via Encryption Component mysql: mysql: Denial of Service via security encryption component
Weaknesses CWE-617
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title MySQL Server and Cluster Denial of Service via Encryption Component
Weaknesses CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T17:32:40.966Z

Reserved: 2026-09-28T15:40:09.504Z

Link: CVE-2026-101749

cve-icon Vulnrichment

Updated: 2026-10-22T17:26:09.322Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:29.973

Modified: 2026-10-28T18:51:35.667

Link: CVE-2026-101749

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:22:41Z

Links: CVE-2026-101749 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T03:00:11Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-617

    Reachable Assertion

  • CWE-770

    Allocation of Resources Without Limits or Throttling