A flaw in Oracle MySQL Server’s parser component allows an attacker to send malformed input that causes the server to hang or crash repeatedly, resulting in a denial of service. The vulnerability does not provide code execution or data disclosure; it only disrupts availability by exploiting improper input validation in how the server processes network traffic. The likely attack vector is remote via crafted packets over standard MySQL connections, as inferred from the description of network access through multiple protocols.

Oracle MySQL Server versions 9.0.0 through 9.5.0 are affected. Attackers require only low privileges but need network access to any of the protocols exposed by the MySQL service, as documented by the vendor’s CPU Jan 2026 advisory.

The CVSS base score of 5.3 reflects moderate availability impact with high attack complexity and low privilege requirements. An EPSS score of less than 1% indicates that exploit attempts are currently uncommon, and the vulnerability is absent from the CISA KEV catalog. Based on the description, it is inferred that the flaw can be triggered remotely via crafted packets over standard MySQL connections, making it a feasible attack vector for disrupting service or augmenting other attacks. No public exploits have been reported, but the impact is immediate once the vulnerability is exploited.