Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

The vulnerability resides in the Optimizer component of Oracle MySQL Server. A low privileged attacker with network access can trigger repeated server crashes or hangs, resulting in a complete denial of service. The weakness impacts Availability only, with no direct effect on data integrity or confidentiality, as reflected in the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected Systems

Oracle Corporation’s MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are affected. All deployments using these releases are vulnerable; version information is provided by Oracle in the referenced CPU.

Risk and Exploitability

The CVSS base score of 6.5 indicates a moderate severity with significant Availability impact. EPSS data is not available, but the vulnerability is described as easily exploitable, requiring only network connectivity and low‑privileged access. It is not listed in the CISA KEV catalog. Attackers can compromise exposed MySQL endpoints by sending crafted queries that cause the Optimizer module to crash, leading to repeated server restarts.

Generated by OpenCVE AI on April 22, 2026 at 05:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patch released by Oracle for MySQL Server, as documented in the CPU for April 2026.
  • If a patch cannot be applied immediately, restrict network access to the MySQL servers by configuring firewalls or access control lists to limit traffic to trusted hosts and enforce the principle of least privilege for client connections.
  • Monitor server logs for abnormal query patterns or sudden service restarts, and configure alerts for repeated crashes to detect exploitation attempts.

Generated by OpenCVE AI on April 22, 2026 at 05:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Wed, 22 Apr 2026 03:15:00 +0000

Type Values Removed Values Added
Title MySQL Server Optimizer DoS Vulnerability
Weaknesses CWE-399
CWE-788

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T14:12:38.085Z

Reserved: 2026-01-05T18:07:34.728Z

Link: CVE-2026-22017

cve-icon Vulnrichment

Updated: 2026-04-22T14:12:34.704Z

cve-icon NVD

Status : Received

Published: 2026-04-21T21:16:28.670

Modified: 2026-04-22T14:16:34.940

Link: CVE-2026-22017

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T05:15:06Z

Weaknesses