Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in Oracle MySQL Connector/J which allows an unauthenticated attacker who can reach the software over a network to trigger a hang or crash. The flaw exposes an availability impact: a successful exploitation can cause the connector to become unresponsive and repeatedly crash, effectively denying service to legitimate users. It is a classic denial‑of‑service weakness, with no confidentiality or integrity compromise.

Affected Systems

The flaw affects Oracle Corporation MySQL Connector/J versions 9.7.0 through 9.7.1. Users of these versions who are exposed to the network via the documented protocols are at risk.

Risk and Exploitability

The CVSS v3.1 score of 6.5 reflects a moderate severity with a high Availability impact, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog and currently requires only network access – no credentials – to attempt an attack. The attacker would need to send a specially crafted request; however, the presence of a user interface interaction requirement suggests that a human trigger from another party is also needed to realize a complete denial.

Generated by OpenCVE AI on August 2, 2026 at 21:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Connector/J to a non‑affected version or apply the Oracle patch release that fixes the issue. This is the recommended and only robust defense.
  • Where a patch is not immediately available, restrict inbound network traffic to the connector using firewall rules, limiting access to known, trusted hosts. This reduces the attack surface and blocks the network exploitation path.
  • Monitor the connector for repeated hangs or crashes using application logs or system monitoring tools; any abnormal termination should trigger an investigation and prompt remedial action.

Generated by OpenCVE AI on August 2, 2026 at 21:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title MySQL Connector/J Denial of Service via Network Exploit

Thu, 30 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Title MySQL Connector/J Denial of Service via Network Exploit

Mon, 27 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-404
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via Unauthenticated Network Exploit in Oracle MySQL Connector/J
Weaknesses CWE-119
CWE-362
CWE-416

Fri, 24 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Unauthenticated Network Exploit in Oracle MySQL Connector/J
Weaknesses CWE-119
CWE-362
CWE-416

Wed, 22 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle mysql Connector/j
Vendors & Products Oracle mysql Connector/j

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Connector\/j
CPEs cpe:2.3:a:oracle:mysql_connector\/j:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/j
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Connector/j Mysql Connector\/j
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-27T12:34:37.391Z

Reserved: 2026-07-08T15:51:40.548Z

Link: CVE-2026-60624

cve-icon Vulnrichment

Updated: 2026-07-27T12:34:32.272Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T21:45:03Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release