Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch promptly
AI Analysis

Impact

Vulnerability discovered in the Optimizer component of Oracle MySQL Server allows a high privileged attacker to cause the server to hang or repeatedly crash, resulting in a denial of service. The defect is a form of uncontrolled resource consumption and memory allocation error, as identified by CWE-400 and CWE-770. The impact is limited to availability; there is no direct compromise of confidentiality or integrity.

Affected Systems

Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are affected. Users of these releases should verify their deployments against the Oracle CPU April 2026 advisory.

Risk and Exploitability

The CVSS base score of 4.9 reflects a moderate availability impact. The EPSS score of < 1% indicates a very low yet non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Successful exploitation requires network access to the MySQL Server and an attacker who possesses high‑level privileges; the most likely attack vector involves sending specially crafted optimizer queries over any of the server’s supported network protocols, a fact that is inferred from the description rather than explicitly stated.

Generated by OpenCVE AI on April 29, 2026 at 00:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle MySQL Server to a non‑vulnerable release (8.0.46+, 8.4.9+, or 9.6.1+).
  • Restrict privileged client access and enforce least privilege for database accounts.
  • Monitor for repeated optimizer requests that result in hangs or crashes and configure alerts to detect repeatable denial‑of‑service patterns.

Generated by OpenCVE AI on April 29, 2026 at 00:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title Denial-of-Service via Optimizer Component Crash in Oracle MySQL Server mysql: Optimizer unspecified vulnerability (CPU Apr 2026)
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 03:15:00 +0000

Type Values Removed Values Added
Title Denial-of-Service via Optimizer Component Crash in Oracle MySQL Server
Weaknesses CWE-400

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T14:03:33.673Z

Reserved: 2026-01-05T18:07:34.723Z

Link: CVE-2026-21998

cve-icon Vulnrichment

Updated: 2026-04-22T14:03:25.747Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-21T21:16:24.863

Modified: 2026-04-23T15:04:45.970

Link: CVE-2026-21998

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-21T00:00:00Z

Links: CVE-2026-21998 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T00:30:16Z

Weaknesses