Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

A vulnerability in the Group Replication Plugin of Oracle MySQL Server allows a low‑privileged attacker with network access through multiple protocols to trigger a hang or recurrent crash of the MySQL Server. An attacker can exploit this flaw to cause a complete denial of service without needing elevated system privileges.

Affected Systems

Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are affected.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 indicates a moderate severity focused on availability. Attack complexity is low, and the requirement is only network access to the MySQL service. The EPSS score of 0.04% and the absence of the vulnerability from CISA’s KEV catalog suggest that publicly available exploits are uncommon. Nonetheless, the potential for recurring service interruption warrants timely remediation.

Generated by OpenCVE AI on April 28, 2026 at 21:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch or upgrade to the latest MySQL Server release that includes the fix released by Oracle.
  • If the Group Replication Plugin is not required, remove or disable it to eliminate the attack surface.
  • Restrict inbound traffic to MySQL ports using firewall rules, allowing only trusted hosts to communicate with the server.
  • Monitor server logs for repeated crash events to identify potential exploitation attempts.

Generated by OpenCVE AI on April 28, 2026 at 21:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title MySQL Server Group Replication Denial‑of‑Service Vulnerability mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026)
Weaknesses CWE-772
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 05:30:00 +0000

Type Values Removed Values Added
Title MySQL Server Group Replication Denial‑of‑Service Vulnerability
Weaknesses CWE-400

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T13:53:09.216Z

Reserved: 2026-03-26T19:48:45.674Z

Link: CVE-2026-34271

cve-icon Vulnrichment

Updated: 2026-04-22T13:53:01.175Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-21T21:16:30.910

Modified: 2026-04-23T15:06:08.753

Link: CVE-2026-34271

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-21T00:00:00Z

Links: CVE-2026-34271 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T21:30:26Z

Weaknesses