Description
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Shell executes to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Shell. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the core client component of Oracle MySQL Shell. It allows a low‑privileged user who can log onto the system where the shell runs to cause the application to hang or crash repeatedly. A successful exploitation results only in an availability impact, with no modification of data or confidentiality compromise.

Affected Systems

Affected versions are Oracle MySQL Shell 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. The flaw exists in the Shell: Core Client component of Oracle MySQL Shell distributed by Oracle.

Risk and Exploitability

The CVSS base score is 5.0, indicating moderate impact on availability. Exploitation requires local access and a low privilege level, and a person other than the attacker must provide user interaction. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw causes a denial of service, an attacker who can obtain local access can disrupt database operations, though no data loss or unauthorized access occurs.

Generated by OpenCVE AI on April 22, 2026 at 07:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and install the latest patch or upgrade to a non‑affected MySQL Shell version as released in Oracle's security advisory.
  • Restrict local user privileges so that only trusted administrators can execute MySQL Shell and disable or limit non-essential instances of the shell on the infrastructure.
  • Monitor MySQL Shell logs for frequent crashes, and if the issue persists after patching, isolate the shell service from the network and apply additional hardening measures such as disabling unused command features.

Generated by OpenCVE AI on April 22, 2026 at 07:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 07:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Local Denial of Service in Oracle MySQL Shell
Weaknesses CWE-400
CWE-689

Wed, 22 Apr 2026 05:15:00 +0000

Type Values Removed Values Added
Title MySQL Shell Local Denial of Service
Weaknesses CWE-201

Wed, 22 Apr 2026 02:45:00 +0000

Type Values Removed Values Added
Title MySQL Shell Local Denial of Service
Weaknesses CWE-201

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Shell executes to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Shell. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Shell
CPEs cpe:2.3:a:oracle:mysql_shell:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Shell
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Shell
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-21T20:35:39.249Z

Reserved: 2026-03-26T19:48:45.681Z

Link: CVE-2026-34317

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-21T21:16:37.183

Modified: 2026-04-21T21:16:37.183

Link: CVE-2026-34317

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T07:15:11Z

Weaknesses