CVE-2026-101609 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the InnoDB storage engine of Oracle MySQL Server and MySQL Cluster products, affecting specific version ranges including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 versions up to 26.7.1, as well as corresponding MySQL Cluster releases from 8.0.0 through 8.0.49 and the same newer version ranges. This flaw is classified under CWE-400, which denotes uncontrolled resource consumption leading to denial of service conditions. The technical nature of this defect allows for a hang or frequent repeatable crash of the database server when triggered by specific malformed inputs or operational sequences within the InnoDB subsystem. Although the vulnerability requires high privileges and network access via multiple protocols to exploit, its existence represents a significant risk to system availability because it enables an authenticated attacker with elevated permissions to disrupt service continuity without necessarily compromising data integrity or confidentiality.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically the sub-category of resource exhaustion attacks that target application-level services rather than network infrastructure. The attack vector involves high-privileged users who already possess valid credentials and network connectivity to the database server. This requirement for authentication means the vulnerability is not remotely exploitable by unauthenticated actors but poses a severe internal threat from compromised administrative accounts or insider threats with elevated access levels. The ability to cause complete denial of service through repeatable crashes indicates that the flaw likely involves improper handling of memory allocation, thread synchronization issues, or infinite loops within critical InnoDB operations such as transaction management, buffer pool interactions, or index maintenance routines.
The operational impact of this vulnerability is primarily centered on availability, which corresponds to the high severity score in the CVSS 3.1 base vector where Availability impacts are rated H while Confidentiality and Integrity remain at N. A successful exploitation results in the MySQL Server process becoming unresponsive or terminating unexpectedly, leading to downtime for all dependent applications that rely on the database service. This can cause significant business disruption, data inconsistency if transactions were interrupted mid-commit, and potential loss of recent writes depending on recovery mechanisms. The difficulty of exploitation suggests that specific conditions must be met, such as particular query patterns or concurrent operations that trigger the underlying bug in the InnoDB engine code path.
Mitigation strategies should focus primarily on version management and access control hardening. Organizations running affected versions must apply the latest security patches provided by Oracle to update MySQL Server and Cluster components beyond the vulnerable ranges. Until patching is feasible, implementing strict network segmentation to limit database port accessibility only to trusted application servers can reduce the attack surface. Additionally, enforcing least-privilege principles for all database accounts ensures that even if credentials are compromised, attackers do not possess the high privileges required to trigger this specific vulnerability. Monitoring tools should be configured to detect abnormal spikes in CPU usage or frequent process restarts associated with MySQL services, which may indicate active exploitation attempts of this denial-of-service flaw.