Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-07-21
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the Replication component of MySQL Server and MySQL Cluster. It allows a high‑privileged attacker with network access via multiple protocols to cause the database process to hang or repeatedly crash, resulting in a complete denial of service. This weakness is reflected in a CVSS v3.1 base score of 4.4 that targets availability only, with no impact on confidentiality or integrity, and is associated with the following CWEs: CWE-284, CWE-770.

Affected Systems

Affected products are Oracle MySQL Server and MySQL Cluster in the version ranges 8.4.0 through 8.4.10, 9.7.0 through 9.7.1, and for the cluster component 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1, as identified by Oracle.

Risk and Exploitability

The exploitability score is very low (EPSS < 1%) and the vulnerability is not yet listed in the CISA KEV catalog. The CVSS v3.1 base score of 4.4 indicates a moderate impact limited to availability, with a vector of AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H. An attacker who can connect to the database over the network and possesses the necessary high‑privileged credentials could trigger a crash via replication operations. No other prerequisites are noted, but the attack likely requires network access through multiple protocols.

Generated by OpenCVE AI on August 2, 2026 at 23:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch or upgrade to a version outside the affected ranges.
  • Restrict network access to the MySQL port(s) to trusted hosts and limit replication traffic to internal networks; enforce least‑privilege replication accounts to mitigate authorization issues (CWE-284).
  • Monitor database health and logs, configure alerts for high memory or CPU usage that may indicate resource exhaustion (CWE-770).

Generated by OpenCVE AI on August 2, 2026 at 23:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 01 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-469

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title MySQL Server/Cluster Denial of Service via Replication Vulnerability mysql: Replication unspecified vulnerability (CPU Jul 2026)
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 24 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title MySQL Server/Cluster Denial of Service via Replication Vulnerability
Weaknesses CWE-400
CWE-469

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T17:04:50.063Z

Reserved: 2026-07-08T15:51:40.520Z

Link: CVE-2026-60189

cve-icon Vulnrichment

Updated: 2026-07-23T16:13:48.984Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-21T00:00:00Z

Links: CVE-2026-60189 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T23:45:03Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-770

    Allocation of Resources Without Limits or Throttling