Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Availability)
Action: Patch
AI Analysis

Impact

The vulnerability resides in the Optimizer component of Oracle MySQL Server, allowing an attacker with low privileges and network access to cause the server to hang or crash repeatedly. This results in a denial of service, affecting only availability with no impact on confidentiality or integrity.

Affected Systems

Affected versions are Oracle MySQL Server 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. The vendor is Oracle Corporation. The issue applies to any installation configured to accept network connections through standard MySQL protocols, such as TCP ports 3306 and 33060.

Risk and Exploitability

The risk level is moderate because the exploit requires only network reachability and low‑privileged access, but it can lead to a complete service disruption. This is reflected in a CVSS base score of 6.5, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower documented exploitation prevalence. An attacker can repeatedly trigger a crash by sending specially crafted queries that exploit the optimizer, leading to downtime until the service is restarted or the patch is applied.

Generated by OpenCVE AI on April 22, 2026 at 06:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle MySQL Server to the latest release that removes this issue (currently releases beyond 8.0.45, 8.4.8, and 9.6.0).
  • If a patch cannot be applied immediately, restrict external access to MySQL ports with firewall rules or place the server behind a strict ACL to limit connections to trusted hosts.
  • Monitor the MySQL process for hangs or crashes and configure automated alerts or fail‑over mechanisms to detect exploitation attempts early.

Generated by OpenCVE AI on April 22, 2026 at 06:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title MySQL Server Optimizer Denial of Service via Network Abuse mysql: Optimizer unspecified vulnerability (CPU Apr 2026)
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 07:00:00 +0000

Type Values Removed Values Added
Title MySQL Server Optimizer Denial of Service via Network Abuse
Weaknesses CWE-400
CWE-770

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T13:27:41.169Z

Reserved: 2026-03-26T19:48:45.678Z

Link: CVE-2026-34303

cve-icon Vulnrichment

Updated: 2026-04-22T13:27:31.631Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-21T21:16:35.547

Modified: 2026-04-23T15:09:54.333

Link: CVE-2026-34303

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-21T00:00:00Z

Links: CVE-2026-34303 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T06:45:10Z

Weaknesses