An exploit in the Optimizer component of Oracle MySQL Server allows a high‑privileged attacker with network access to cause a hang or crash that repeatedly restarts the server, thereby creating a denial of service for all database users. The flaw can be triggered via multiple network protocols and requires elevated privileges, but it does not lead to data disclosure or modification.

The vulnerability affects Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. Only the mentioned Oracle MySQL product is impacted; no other vendors or products are listed.

The CVSS v3.1 Base Score is 4.9, indicating a moderate impact on availability and no impact on confidentiality or integrity. The attack vector is network, with low complexity, high privilege required, and no user interaction needed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation at this time. Nonetheless, the exploitation requirements—network access and privileged credentials—make it a realistic threat within an internal or compromised environment.