Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in Oracle MySQL Server’s InnoDB component. A high‑privileged attacker with network access through any supported protocol can force the server to crash or hang repeatedly, leading to a complete denial of service. The impact is limited to availability; confidentiality and integrity are not affected.

Affected Systems

Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are affected. Any deployment of these releases that is exposed to the network is a potential target. The flaw is specific to the InnoDB component within MySQL Server.

Risk and Exploitability

The CVSS base score of 4.9 classifies the flaw as moderate severity. Since the attack vector requires network access and high privileges, the risk is mitigated by proper access controls. No publicly available exploit is listed, EPSS score is less than 1%, and the vulnerability is not in the CISA KEV catalog. Nonetheless, the ability to repeatedly crash the service poses a serious operational risk for database infrastructures that cannot tolerate downtime.

Generated by OpenCVE AI on April 28, 2026 at 21:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify the MySQL Server version; if it falls within any affected range, schedule an upgrade to the latest patched release.
  • Apply the Oracle MySQL Server security update released for this vulnerability as soon as it becomes available.
  • Restrict external access to the MySQL ports and use firewall rules to block vulnerable protocols until the patch is applied.

Generated by OpenCVE AI on April 28, 2026 at 21:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title Oracle MySQL Server Vulnerability Allows High‑Privileged Attacker to Induce Denial of Service mysql: InnoDB unspecified vulnerability (CPU Apr 2026)
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 03:15:00 +0000

Type Values Removed Values Added
Title Oracle MySQL Server Vulnerability Allows High‑Privileged Attacker to Induce Denial of Service
Weaknesses CWE-400

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T14:11:22.026Z

Reserved: 2026-01-05T18:07:34.725Z

Link: CVE-2026-22004

cve-icon Vulnrichment

Updated: 2026-04-22T14:11:15.727Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-21T21:16:25.857

Modified: 2026-04-23T15:03:35.550

Link: CVE-2026-22004

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-21T00:00:00Z

Links: CVE-2026-22004 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T21:30:26Z

Weaknesses