Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin. It permits an attacker with high privileges and network access to send crafted replication messages, triggering a resource exhaustion condition that causes the database server or cluster nodes to hang or crash, resulting in a complete denial of service while leaving confidentiality and integrity intact.

Affected Systems

Affected installations include Oracle MySQL Server 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, and 26.7.0 to 26.7.1, as well as Oracle MySQL Cluster versions 8.0.0 to 8.0.49, 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, and 26.7.0 to 26.7.1. All affected systems expose standard MySQL networking protocols, and the flaw is limited to the Group Replication Plugin component.

Risk and Exploitability

The CVSS 3.1 base score of 4.9 reflects significant availability impact. The attack requires network access and high‑privilege authentication, but the exploit is described as easily exploitable once those conditions are met. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploit exists yet. Nonetheless, environments exposing these services to untrusted networks face a moderate risk, with a straightforward attack path: sending crafted replication traffic over any MySQL ingress protocol.

Generated by OpenCVE AI on October 23, 2026 at 05:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle MySQL Server or MySQL Cluster security patches that address the Group Replication Plugin flaw.
  • Restrict network access to the MySQL service ports and limit Group Replication traffic to trusted hosts only.
  • If a patch is unavailable, disable the Group Replication Plugin or remove it from the server configuration to eliminate the vulnerable code path.

Generated by OpenCVE AI on October 23, 2026 at 05:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title DoS Vulnerability in Oracle MySQL Server and MySQL Cluster Group Replication Plugin mysql: mysql: Denial of Service in Group Replication plugin
Weaknesses CWE-835
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Title DoS Vulnerability in Oracle MySQL Server and MySQL Cluster Group Replication Plugin
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T17:30:42.919Z

Reserved: 2026-09-28T15:40:09.505Z

Link: CVE-2026-101776

cve-icon Vulnrichment

Updated: 2026-10-22T17:26:41.363Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:33.127

Modified: 2026-10-30T15:08:39.047

Link: CVE-2026-101776

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:22:51Z

Links: CVE-2026-101776 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T05:30:03Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')