A flaw in the MySQL Server and MySQL Cluster allows an attacker who can reach the database from the network to cause the service to become unresponsive or crash repeatedly. The vulnerability is triggered by a difficult‑to‑exploit condition that overloads server resources when handling requests. Because it requires a high‑privileged attacker with network access and the effort is high, the impact is limited to availability rather than confidentiality or integrity, but a successful attack can halt critical database operations.

Oracle MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1 are affected. Both server and cluster components in these version ranges are vulnerable to the described denial of service.

The CVSS 3.1 base score of 4.4 indicates a moderate severity level focused on availability. The EPSS score of <1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is currently unlikely. An attacker must have high privileges and network access to the MySQL ports, and the attack requires effort to craft the exploiting traffic; once achieved, the database can hang or crash repeatedly, disrupting dependent services until remediated.