An exploit in the Optimizer component of Oracle MySQL Server allows a high‑privileged attacker with network access to cause a hang or crash that repeatedly restarts the server, thereby creating a denial of service for all database users. The flaw can be triggered via multiple network protocols and requires elevated privileges, but it does not lead to data disclosure or modification. This issue is linked to improper access control (CWE‑284) and allocation of resources without limits (CWE‑770).

The vulnerability affects Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. Only the mentioned Oracle MySQL product is impacted; no other vendors or products are listed.

The CVSS v3.1 Base Score is 4.9, indicating a moderate impact on availability and no impact on confidentiality or integrity. This impact arises from improper access control (CWE‑284) and allocation of resources without limits (CWE‑770), leading to denial of service. The attack vector is network, with low complexity, high privilege required, and no user interaction needed. The EPSS score of less than 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation at this time. Nonetheless, the exploitation requirements—network access and privileged credentials—make it a realistic threat within an internal or compromised environment.