Vulnerability exists in the client programs component of Oracle MySQL Server and MySQL Cluster. The weakness stems from improper access control (CWE-284) and infinite loop handling (CWE-835). A low‑privilege attacker who can reach the database over the network using supported protocols can trigger a hang or repeatable crash. When successfully exploited, the database service becomes unavailable, causing a denial of service. The impact is limited to availability only, as confidentiality and integrity are not affected. The CVSS v3.1 base score is 5.3, reflecting the high effort and low privilege requirements for exploitation.

Oracle Corporation’s MySQL Server and MySQL Cluster are affected. The specific product versions impacted are 26.7.0 through 26.7.1 for both Server and Cluster. No other versions were listed as vulnerable in the advisory.

The attack vector requires network access; it is deemed difficult to exploit but does not require any privileged state beyond a low‑privilege attacker. An adversary could repeatedly send crafted client requests over multiple protocols to force the server into a crash state, effectively taking the database offline. The CVSS score of 5.3 places the vulnerability in the medium severity band, but the lack of code‑execution or data‑exfiltration reduces overall risk. The EPSS score of less than 1% indicates a very low exploitation probability, and the vulnerability is not currently listed in CISA’s KEV catalog, indicating fewer observed attacks at present. Nevertheless, the potential for service disruption warrants prompt remediation.