CVE-2026-101777 - Vulnerability Details

- mysql: mysql: Denial of Service via security encryption component

Description

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H).

Published: 2026-10-20

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in Oracle MySQL Server and MySQL Cluster allows a high‑privileged attacker with network access to trigger service hangs or repeatable crashes, thereby denying legitimate users access to the database. In addition, the flaw permits the attacker to read a subset of data that should have been protected. This weakness is rooted in improper privilege management and information exposure, resulting in availability and confidentiality impacts.

Affected Systems

Oracle MySQL Server versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, and Oracle MySQL Cluster versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1 are vulnerable. The issue resides in the Server component of the Security: Encryption feature within these products.

Risk and Exploitability

The CVSS base score of 5.5 indicates a moderate risk level. The EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. Attackers must first obtain high‑privilege credentials or local administrator access to the MySQL environment, then use remote network protocols to induce crashes or read data. Successful exploitation results in a denial of service and potential data exposure.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

MySQL Server

affected

Version	Status	Constraints
`9.7.0-9.7.3`	affected	—
`26.7.0-26.7.1`	affected	—

Oracle Corporation

MySQL Cluster

affected

Version	Status	Constraints
`9.7.0-9.7.3`	affected	—
`26.7.0-26.7.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_cluster::::::::
	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:mysql_server::::::::

No data.

Vendor Product Confidence Versions

Oracle

Mysql Cluster

100%

Version	Status	Scheme	Platform
`[9.7.0,9.7.3]`	affected	semver	—
`[26.7.0,26.7.1]`	affected	semver	—

Oracle

Mysql Server

100%

Version	Status	Scheme	Platform
`[9.7.0,9.7.3]`	affected	semver	—
`[26.7.0,26.7.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any Oracle‑released patch or update that addresses this vulnerability as soon as it becomes available. If a patch is not yet released, plan to upgrade to the latest supported mysql release once the fix is applied.
Enforce the principle of least privilege by configuring the MySQL service to run under an account with minimal permissions and by removing any unnecessary high‑privileged database roles.
Restrict network access to the MySQL services by limiting the exposed ports to trusted hosts and disabling unused network protocols, thereby reducing the attack surface.

Generated by OpenCVE AI on October 23, 2026 at 05:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00369.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-101777
https://www.cve.org/CVERecord?id=CVE-2026-101777
https://www.oracle.com/security-alerts/cpuoct2026.html

History

Fri, 23 Oct 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-285

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Title	MySQL Server/Cluster Unauthorized Data Access and Denial of Service via Security: Encryption Component	mysql: mysql: Denial of Service via security encryption component
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-101777 https://www.cve.org/CVERecord?id=CVE-2026-101777
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 22 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 21 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Title		MySQL Server/Cluster Unauthorized Data Access and Denial of Service via Security: Encryption Component
Weaknesses		CWE-200 CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H).
First Time appeared		Oracle Oracle mysql Cluster Oracle mysql Server
CPEs		cpe:2.3:a:oracle:mysql_cluster:::::::: cpe:2.3:a:oracle:mysql_server::::::::
Vendors & Products		Oracle Oracle mysql Cluster Oracle mysql Server
References		https://www.oracle.com/security-alerts/cpuoct2026.html
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H'}`

Subscriptions

Oracle Mysql Cluster Mysql Server

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2026-10-20T21:22:52.213Z

Updated: 2026-10-22T17:22:21.578Z

Reserved: 2026-09-28T15:40:09.506Z

Link: CVE-2026-101777

Vulnrichment

Updated: 2026-10-22T17:02:11.248Z

NVD

Status : Analyzed

Published: 2026-10-20T22:18:33.253

Modified: 2026-10-30T15:08:49.157

Link: CVE-2026-101777

Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:22:52Z

Links: CVE-2026-101777 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T05:30:03Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-284
Improper Access Control

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object