Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The vulnerability resides in the DML component of Oracle MySQL Server. A high privileged attacker with network access, using any of the supported database protocols, can craft a request that triggers the server to hang or crash. The result is a loss of service for all users of the affected MySQL instance, with no disclosure of data manipulation or code execution capabilities.

Affected Systems

Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are susceptible. The issue exists in the server module that processes data manipulation language statements. All installations of these releases should be checked.

Risk and Exploitability

The CVSS 3.1 base score of 4.9 indicates moderate severity focused on availability. The EPSS score is less than 1%, implying a low but nonzero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attacks require network access and elevated privileges, suggesting they would be targeted rather than widespread.

Generated by OpenCVE AI on April 28, 2026 at 15:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle MySQL Server to a version later than 8.0.45, 8.4.8, or 9.6.0 to apply the vendor’s fix.
  • Restrict network access to the MySQL service by configuring firewalls or host-based rules so that only trusted hosts can connect.
  • Monitor database logs for unusually large or malformed DML statements and consider disabling DML operations for untrusted clients until a patch is applied.

Generated by OpenCVE AI on April 28, 2026 at 15:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Thu, 23 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via DML in Oracle MySQL Server mysql: DML unspecified vulnerability (CPU Apr 2026)
Weaknesses CWE-772
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 22 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 05:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via DML in Oracle MySQL Server
Weaknesses CWE-400

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T15:33:13.935Z

Reserved: 2026-04-01T20:03:40.833Z

Link: CVE-2026-35239

cve-icon Vulnrichment

Updated: 2026-04-22T15:20:32.837Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-21T21:16:39.703

Modified: 2026-04-23T15:08:54.547

Link: CVE-2026-35239

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-21T00:00:00Z

Links: CVE-2026-35239 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T16:00:13Z

Weaknesses