Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-04-21
Score: 4.9 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The vulnerability resides in the DML component of Oracle MySQL Server. A high privileged attacker with network access, using any of the supported database protocols, can form a request that causes the server to hang or terminate in a crash. The result is a loss of service for all users of the affected MySQL instance. No compromise of data or code execution is disclosed; the impact is purely an availability disruption.

Affected Systems

Oracle MySQL Server from versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0 are susceptible. The issue is present within the server component that processes data manipulation language statements. All installation instances of these releases should be verified.

Risk and Exploitability

The CVSS 3.1 base score of 4.9 indicates moderate severity with an availability focus. The EPSS score is not available, so the current exploit probability is unknown; however the requirement for network access and high privileges implies that the attack would be targeted rather than widespread. The vulnerability is not listed in CISA’s KEV catalog, reflecting that no known widespread exploitation has been observed.

Generated by OpenCVE AI on April 22, 2026 at 04:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle MySQL Server to a version later than 8.0.45, 8.4.8, or 9.6.0 to apply the vendor’s fix.
  • Restrict network access to the MySQL service by configuring firewalls or host‑based rules so that only trusted hosts can connect.
  • Monitor database logs for unusually large or malformed DML statements and consider disabling DML operations for untrusted clients until a patch is applied.

Generated by OpenCVE AI on April 22, 2026 at 04:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 05:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via DML in Oracle MySQL Server
Weaknesses CWE-400

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-21T20:35:48.110Z

Reserved: 2026-04-01T20:03:40.833Z

Link: CVE-2026-35239

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-21T21:16:39.703

Modified: 2026-04-21T21:16:39.703

Link: CVE-2026-35239

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T05:00:09Z

Weaknesses