CVE-2026-46862

Denial of Service via Unauthenticated Network Access in Oracle MySQL Router 8.4.0‑9.7.0

Published Jun 16, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Analysis

Technical impact

A vulnerability in Oracle MySQL Router versions 8.4.0 through 9.7.0 allows an unauthenticated attacker with network access over TLS to trigger a crash or repeated hang, resulting in a complete denial of service. The flaw resides in the Router: General component and is exploitable through remote network traffic. Although the attack does not affect confidentiality or integrity, it can bring the router offline and disrupt database connectivity for all users relying on it.

Affected Systems

Affected systems include Oracle Corporation’s MySQL Router product. The specific versions impacted are 8.4.0–8.4.9 and 9.0.0–9.7.0. Any deployment of MySQL Router within these version ranges should be considered vulnerable until patched.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 indicates a high availability impact. The EPSS score below 1% shows a very low but non-zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely execution requires only network connectivity over TLS, with no authentication or special privileges. An attacker can repeatedly send crafted requests to trigger the crash, causing service interruption for affected clients.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

MySQL Router

affected

Version	Status	Constraints
`8.4.0`	affected	≤ 8.4.9
`9.0.0`	affected	≤ 9.7.0

Configuration 1 [-]

OR	cpe:2.3:a:oracle:mysql_router::::::::
	cpe:2.3:a:oracle:mysql_router::::::::

No data.

Vendor Product Versions

Oracle

Mysql Router

Version	Status	Scheme	Platform
`[8.4.0,8.4.9]`	affected	semver	—
`[9.0.0,9.7.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update MySQL Router to the latest patched version that resolves the crash issue
If a patch is not immediately available, restrict TLS access to the router to trusted IP addresses or networks to limit exposure
After applying the patch or adding restrictions, monitor the router’s log and uptime to ensure it remains operational

Generated by OpenCVE AI on June 17, 2026 at 18:20 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8457-1	MySQL vulnerabilities
Ubuntu USN	USN-8457-2	MySQL vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.463% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Unauthenticated Network Access in Oracle MySQL Router 8.4.0‑9.7.0
Weaknesses		CWE-400
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared		Oracle Oracle mysql Router
CPEs		cpe:2.3:a:oracle:mysql_router::::::::
Vendors & Products		Oracle Oracle mysql Router
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`