CVE-2026-34272

mysql: Optimizer unspecified vulnerability (CPU Apr 2026)

Published Apr 21, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Analysis

Technical impact

The vulnerability exists in the Optimizer component of Oracle MySQL Server. A low privileged attacker with network access can trigger a crash or hang in the server, leading to a complete denial of service. The primary impact is loss of availability; confidentiality and integrity are not directly affected.

Affected Systems

Oracle Corporation’s MySQL Server versions 9.0.0 through 9.6.0 are affected. These versions are commonly deployed in web and application environments that rely on MySQL for backend storage.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 indicates moderate severity, with the availability dimension rated high while confidentiality and integrity remain unaffected. An EPSS score of < 1% indicates a very low probability that the vulnerability will be exploited, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. However, the attack vector is network based, requires low privileges, and thus the risk of successful exploitation remains significant for exposed MySQL instances.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

MySQL Server

affected

Version	Status	Constraints
`9.0.0`	affected	≤ 9.6.0

Configuration 1 [-]

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Mysql Server

Version	Status	Scheme	Platform
`[9.0.0,9.6.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Oracle MySQL Server to the latest release that includes the security fix for the Optimizer bug
Restrict network access to the MySQL service by configuring firewall rules to allow only trusted IPs, thereby reducing the attack surface for low‑privileged attackers
Continuously monitor MySQL logs and system metrics for signs of repeated crashes or abnormal query traffic, and implement automated alerts or scheduled restarts to maintain availability

Generated by OpenCVE AI on April 29, 2026 at 02:29 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.303% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-34272
https://www.cve.org/CVERecord?id=CVE-2026-34272
https://www.oracle.com/security-alerts/cpuapr2026.html
https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixMSQL

History

Apr 29, 2026 12:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-399

Apr 23, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	MySQL Server Optimizer Component Denial of Service via Low-Privilege Network Exploit	mysql: Optimizer unspecified vulnerability (CPU Apr 2026)
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-34272 https://www.cve.org/CVERecord?id=CVE-2026-34272 https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixMSQL
Metrics	threat_severity `None`	threat_severity `Moderate`

Apr 22, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 5:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		MySQL Server Optimizer Component Denial of Service via Low-Privilege Network Exploit
Weaknesses		CWE-399 CWE-400

Apr 22, 2026 12:00 AM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared		Oracle Oracle mysql Server
CPEs		cpe:2.3:a:oracle:mysql_server::::::::
Vendors & Products		Oracle Oracle mysql Server
References		https://www.oracle.com/security-alerts/cpuapr2026.html
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`