A flaw exists in the DML component of Oracle MySQL Server that can be triggered by an attacker who has high privileges and network access. The vulnerability allows the attacker to send crafted commands that cause the server process to hang or crash repeatedly, resulting in a denial of service. The vulnerability impacts only availability and does not directly compromise confidentiality or integrity.

Affected systems: Oracle MySQL Server versions 8.0.0 through 8.0.45 are impacted. The vulnerability applies to all installations of these releases that use network access via standard MySQL protocols.

Risk and exploitability: The CVSS 3.1 base score of 4.9 indicates a moderate severity focused on availability. The EPSS score of < 1% indicates that the likelihood of exploitation is very low. The vulnerability is not listed in CISA’s KEV catalog. The attacker must have high privileges and be able to connect to the MySQL instance over the network to submit malicious DML statements. Based on the description, it is inferred that an insider or compromised host could exploit it, and that external attackers might also succeed if the database is exposed to the internet.