Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via MySQL Server crash
Action: Patch
AI Analysis

Impact

The vulnerability is located in the Optimizer component of Oracle MySQL Server and permits a high privileged attacker with network access to cause the server to hang or repeatedly crash. The effect is a complete denial of service, impacting availability only.

Affected Systems

Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are affected. These versions include all releases within those ranges for the MySQL Server product from Oracle.

Risk and Exploitability

The CVSS v3.1 Base Score is 4.9, indicating moderate severity with a purely availability impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network-based via multiple protocols; an attacker must possess high privileges to trigger the crash. The ability to cause a full service halt raises the risk for systems exposed to potentially insecure networks, underscoring the importance of timely remediation.

Generated by OpenCVE AI on April 22, 2026 at 07:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle MySQL Server to any release newer than 8.0.45, 8.4.8, or 9.6.0 to apply the vendor fix.
  • Apply any additional Oracle security updates that address optimizer behavior for versions within or above the affected ranges.
  • Restrict network access to MySQL Server to trusted hosts and disable unnecessary protocols to limit exposure to potential attackers.
  • Monitor MySQL Server logs for crash events and apply additional isolation measures if repeated hangs occur.

Generated by OpenCVE AI on April 22, 2026 at 07:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 07:30:00 +0000

Type Values Removed Values Added
Title MySQL Server Optimizer Crash Allowing Denial of Service
Weaknesses CWE-400
CWE-770

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T14:12:16.029Z

Reserved: 2026-01-05T18:07:34.726Z

Link: CVE-2026-22005

cve-icon Vulnrichment

Updated: 2026-04-22T14:12:05.460Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-04-21T21:16:26.040

Modified: 2026-04-22T21:24:26.997

Link: CVE-2026-22005

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T07:15:11Z

Weaknesses