Vulnerability discovered in the Optimizer component of Oracle MySQL Server allows an attacker with high privileges to trigger a hang or crash, resulting in a denial of service. The flaw is exploitable over the network using any supported protocol and requires an attacker to possess elevated privileges. Once triggered, the server becomes unavailable, impacting only availability with no direct effect on confidentiality or integrity. The CVSS 3.1 base score of 4.9 reflects a low to medium severity availability vulnerability.

Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are vulnerable. Users running these releases should verify their deployment against the Oracle CPU April 2026 advisory.

Because the CVSS score indicates moderate availability impact and the EPSS is not available, the exploitation likelihood is uncertain but not considered high. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. An attacker with network connectivity and elevated privileges could exploit the flaw by sending malformed optimizer requests, leading to a crash. Standard denial‑of‑service defenses such as monitoring for repeated crashes and restricting privileged network access mitigate the risk.