Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-01-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

The vulnerability resides in the Optimizer component of Oracle MySQL Server and is classified as a resource consumption flaw (CWE‑400). Exploitation can cause the server to hang or repeatedly crash, resulting in a complete denial of service to any application or user relying on the database.

Affected Systems

Oracle MySQL Server versions from 9.0.0 through 9.5.0 are affected. Administrators should verify the exact build and apply the security patch provided by Oracle for these releases.

Risk and Exploitability

With a CVSS base score of 6.5, the vulnerability primarily impacts availability. The EPSS score is below 1 %, indicating a low probability of exploitation, and it is currently not listed in the CISA KEV catalogue. The likely attack vector is a remote, low‑privileged network user sending specially crafted SQL statements over supported protocols, which triggers the optimizer bug and causes the service to crash.

Generated by OpenCVE AI on April 18, 2026 at 04:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle MySQL Server patch released for the January 2026 CPU, which addresses the optimizer bug and restores stability.
  • After updating, restart the MySQL service and verify that the server accepts connections and processes queries normally.
  • If patching cannot be performed immediately, isolate the database server from untrusted networks and tightly control firewall rules to limit exposure to the known vulnerable protocols.
  • Monitor MySQL logs for unexpected hangs or terminate signals and apply additional rate‑limiting on query submission to mitigate accidental resource exhaustion.

Generated by OpenCVE AI on April 18, 2026 at 04:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
Title mysql: Optimizer unspecified vulnerability (CPU Jan 2026)
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 21 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-01-21T15:15:52.637Z

Reserved: 2026-01-05T18:07:34.712Z

Link: CVE-2026-21949

cve-icon Vulnrichment

Updated: 2026-01-21T15:14:54.572Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-20T22:15:57.877

Modified: 2026-01-29T15:22:31.110

Link: CVE-2026-21949

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-01-20T00:00:00Z

Links: CVE-2026-21949 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T04:45:36Z

Weaknesses