Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Optimizer component of Oracle MySQL Server and MySQL Cluster allows an attacker with low privileges and network access to trigger a hang or crash, causing a complete denial of service. The vulnerability is a classic example of improper access control (CWE‑284) combined with resource exhaustion (CWE‑770). It does not compromise confidentiality or integrity; its primary impact is to make the database unavailable to legitimate users.

Affected Systems

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as Oracle MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1 are affected. All other versions are not known to be impacted.

Risk and Exploitability

The CVSS 3.1 score of 6.5 indicates a moderate severity with availability as the sole impact. The EPSS score of less than 1% suggests low exploitation probability at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through network protocols such as TCP or UDP that the MySQL services accept, requiring no authentication or elevated privileges. An attacker could repeatedly send crafted queries or initiate connections to exhaust resources and force the server or cluster to crash.

Generated by OpenCVE AI on August 4, 2026 at 04:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch released in the July 2026 security advisory to all affected MySQL Server and MySQL Cluster installations.
  • Upgrade to a non‑affected major release, such as MySQL Server 8.4.11 or later, or MySQL Cluster 8.0.48 or later, if compatible with your environment.
  • Enforce strict network segmentation so that only trusted hosts can reach MySQL ports, and consider placing additional firewall or VPN barriers to reduce surface area for exploitation.
  • Monitor database logs for abnormal disconnections or repeated crash events, and correlate them with incoming traffic patterns for early detection.

Generated by OpenCVE AI on August 4, 2026 at 04:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via Optimizer Component in MySQL Server and Cluster mysql: Optimizer unspecified vulnerability (CPU Jul 2026)
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 24 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title Denial of Service via Optimizer Component in MySQL Server and Cluster
Weaknesses CWE-400
CWE-770

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T17:05:56.269Z

Reserved: 2026-05-18T15:55:10.319Z

Link: CVE-2026-47064

cve-icon Vulnrichment

Updated: 2026-07-23T16:13:40.253Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:17:12.383

Modified: 2026-07-27T14:52:01.920

Link: CVE-2026-47064

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-21T00:00:00Z

Links: CVE-2026-47064 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T05:00:05Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-770

    Allocation of Resources Without Limits or Throttling