Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-07-21
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in MySQL’s replication logic permits an attacker with high privileges and network connectivity to the database to cause the server or cluster to hang or crash. The vulnerability does not affect confidentiality or integrity, but it can render the database unavailable by repeatedly shutting down or freezing the MySQL process. This flaw maps to CWE‑400 and CWE‑770, indicating uncontrolled resource consumption and excessive allocation limits that enable replication to exhaust resources, leading to hangs or crashes.

Affected Systems

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1; Oracle MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.

Risk and Exploitability

The CVSS base score of 4.4 indicates a medium severity level focused solely on availability. The EPSS score of less than 1 % shows a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation is explicitly described as difficult and requires the attacker to possess high‑privilege database access and network connectivity over standard database protocols. If the flaw is triggered, the server can hang or frequently crash, disrupting database services. The flaw is classified under CWE‑400 and CWE‑770, reflecting uncontrolled resource consumption and excessive allocation limits.

Generated by OpenCVE AI on August 2, 2026 at 23:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle CPU Jul 2026 update that fixes the replication component in MySQL Server and Cluster
  • Restrict external network access to MySQL replication ports (e.g., 3306) by limiting connections to trusted hosts only
  • Configure replication to enforce resource limits and prevent excessive resource allocation
  • Add health‑check logic to detect unexpected hangs or crashes and automatically restart the MySQL service or redirect traffic to a healthy node

Generated by OpenCVE AI on August 2, 2026 at 23:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Denial of Service via Replication in MySQL Server and Cluster mysql: Replication unspecified vulnerability (CPU Jul 2026)
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 25 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Replication in MySQL Server and Cluster
Weaknesses CWE-770

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T15:01:47.556Z

Reserved: 2026-07-08T15:51:40.519Z

Link: CVE-2026-60185

cve-icon Vulnrichment

Updated: 2026-07-23T15:01:39.453Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-21T00:00:00Z

Links: CVE-2026-60185 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T23:45:03Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling