The vulnerability is present in the Group Replication GCS component of MySQL Server and MySQL Cluster. It permits an unauthenticated attacker who can access the physical communication segment linking to the database to transmit specially crafted packets that cause the server to hang or crash, producing a complete denial of service. The flaw does not affect data confidentiality or integrity; the primary impact is a loss of availability.

Affected products include Oracle MySQL Server and Oracle MySQL Cluster. The vulnerability exists in MySQL Server versions 8.4.0-through-8.4.12, 9.7.0-through-9.7.3, and 26.7.0-through-26.7.1; and in MySQL Cluster versions 8.0.0-through-8.0.49, 8.4.0-through-8.4.12, 9.7.0-through-9.7.3, and 26.7.0-through-26.7.1. All builds that use the Group Replication GCS component are at risk; those that have removed or disabled it are not.

The CVSS 3.1 base score is 6.5 with an Availability impact, and the attack vector is adjacent network (physical communication segment). Because the vulnerability requires physical proximity and no authentication, an attacker could manually inject packets into the segment and trigger the crash. The EPSS score indicates a low probability of exploitation, less than 1%; this aligns with the moderate risk assessment. The KEV listing is not present, meaning no known public exploit exists, but the ease of exploitation still warrants remediation. The absence of remote or enumerative requirements does not eliminate the threat to environments that share the segment with the database. Disabling or removing Group Replication GCS removes this vulnerability entirely, and segregating the physical communication segment from other network traffic can reduce the likelihood of an attacker injecting malicious packets.