A flaw in the JSON handling module of Oracle MySQL Server allows a low-privileged attacker with network connectivity to send malformed JSON data that forces the server to hang or crash repeatedly, causing a denial-of-service. The weakness is one of resource exhaustion, allowing the attacker to repeatedly consume server resources until the instance becomes unresponsive. The associated CVSS vector confirms a high impact on availability with no compromise of confidentiality or integrity.

Oracle Corporation’s MySQL Server product is affected. Version ranges include 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. All installations that use the JSON module within these release ranges are at risk.

The CVSS score of 6.5 indicates a medium severity vulnerability, and the lack of an EPSS score or KEV listing implies there are currently no widespread exploit observations. However, the vulnerability can be triggered over any public or private network protocol supported by MySQL, meaning that any host exposed to the service is a potential target. Attackers require only network access and a basic credential or even anonymous connection depending on the configuration, making the threat realistic in many environments.