A vulnerability in Oracle MySQL Router versions 8.4.0 through 9.7.0 allows an unauthenticated attacker with network access over TLS to trigger a crash or repeated hang, resulting in a complete denial of service. The flaw resides in the Router: General component and is exploitable through remote network traffic. Although the attack does not affect confidentiality or integrity, it can bring the router offline and disrupt database connectivity for all users relying on it.

Affected systems include Oracle Corporation’s MySQL Router product. The specific versions impacted are 8.4.0–8.4.9 and 9.0.0–9.7.0. Any deployment of MySQL Router within these version ranges should be considered vulnerable until patched.

The CVSS 3.1 base score of 7.5 indicates a high availability impact. The EPSS score below 1% shows a very low but non-zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely execution requires only network connectivity over TLS, with no authentication or special privileges. An attacker can repeatedly send crafted requests to trigger the crash, causing service interruption for affected clients.