CVE-2026-34267

mysql: Optimizer unspecified vulnerability (CPU Apr 2026)

Published Apr 21, 2026 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Analysis

Technical impact

Oracle MySQL Server’s Optimizer component contains a flaw that can be triggered by a high‑privileged attacker with network access. When exercised, the server either hangs or crashes, permanently disrupting database availability, which translates into a complete denial of service.

Affected Systems

Oracle MySQL Server versions 8.0.0 through 8.0.45 are affected. These releases are part of the mainstream Oracle MySQL distribution for enterprises.

Risk and Exploitability

The CVSS base score of 4.9 indicates a moderate availability impact. The EPSS score of <1% indicates a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires high privileged credentials and network access, and can be performed over multiple network protocols. If a functional exploit were discovered, it could repeatedly bring the database server offline until a patch is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

MySQL Server

affected

Version	Status	Constraints
`8.0.0`	affected	≤ 8.0.45

Configuration 1 [-]

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Mysql Server

Version	Status	Scheme	Platform
`[8.0.0,8.0.45]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a supported MySQL version that fixes the Optimizer flaw (e.g., 8.0.46 or later).
Apply the Oracle security patch that specifically addresses the Optimizer vulnerability once it becomes available.
Restrict network traffic to the MySQL port, limiting connections to trusted hosts to reduce exposure to high‑privileged attackers.

Generated by OpenCVE AI on April 29, 2026 at 02:47 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8363-1	MySQL vulnerabilities
Ubuntu USN	USN-8363-2	MySQL vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.323% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-34267
https://www.cve.org/CVERecord?id=CVE-2026-34267
https://www.oracle.com/security-alerts/cpuapr2026.html
https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixMSQL

History

Apr 29, 2026 12:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-733

Apr 23, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Optimizer Component in MySQL 8.0 Leading to Server Crash	mysql: Optimizer unspecified vulnerability (CPU Apr 2026)
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-34267 https://www.cve.org/CVERecord?id=CVE-2026-34267 https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixMSQL
Metrics	threat_severity `None`	threat_severity `Moderate`

Apr 22, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 3:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Optimizer Component in MySQL 8.0 Leading to Server Crash
Weaknesses		CWE-400 CWE-733

Apr 22, 2026 12:00 AM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared		Oracle Oracle mysql Server
CPEs		cpe:2.3:a:oracle:mysql_server::::::::
Vendors & Products		Oracle Oracle mysql Server
References		https://www.oracle.com/security-alerts/cpuapr2026.html
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`