Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-01-20
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Availability)
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Optimizer component of Oracle MySQL Server and allows a high privileged attacker who can reach the server over the network to cause the database to hang or crash repeatedly. This results in complete denial of service, affecting availability while confidentiality and integrity remain untouched. The weakness is a Resource Exhaustion flaw (CWE‑400).

Affected Systems

Oracle MySQL Server versions from 8.0.0 through 8.0.44, 8.4.0 through 8.4.7 and 9.0.0 through 9.5.0 are impacted. Users of these releases should confirm their environment version and plan an upgrade.

Risk and Exploitability

With a CVSS 3.1 base score of 4.9 and an EPSS below 1%, the likelihood of exploitation is judged low, and the vulnerability is not listed in the CISA KEV catalog. The poisoning requires the attacker to have high privileges and network access; once achieved, the effect is a total service disruption. Existing mitigations such as limiting concurrent connections or disabling optimizations could reduce risk, but the most reliable protection comes from applying the official fix.

Generated by OpenCVE AI on April 18, 2026 at 15:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle January 2026 security patch for MySQL Server, upgrading to a version newer than 8.0.44, 8.4.7, or 9.5.0 (e.g., 8.0.45, 8.4.8, or 9.6.0).
  • Restrict network access to the MySQL service to trusted hosts or networks with firewall rules or security groups, limiting high‑privileged connections.
  • Monitor MySQL logs for hang or crash events and configure automatic restart or high‑availability failover to reduce downtime.

Generated by OpenCVE AI on April 18, 2026 at 15:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-7994-1 MySQL vulnerabilities
History

Wed, 11 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
Title mysql: Optimizer unspecified vulnerability (CPU Jan 2026)
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-01-21T15:12:07.779Z

Reserved: 2026-01-05T18:07:34.712Z

Link: CVE-2026-21948

cve-icon Vulnrichment

Updated: 2026-01-21T15:11:49.285Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-20T22:15:57.757

Modified: 2026-01-29T15:30:25.687

Link: CVE-2026-21948

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-01-20T00:00:00Z

Links: CVE-2026-21948 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T15:45:04Z

Weaknesses