CVE-2026-101611 in MySQL Server
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the InnoDB storage engine of Oracle MySQL Server and MySQL Cluster products, affecting specific version ranges including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 versions up to 26.7.1, as well as corresponding MySQL Cluster releases from 8.0.0 through 8.0.49 and the same newer version ranges. This flaw is classified under CWE-400, which denotes uncontrolled resource consumption leading to denial of service conditions. The technical nature of this vulnerability involves a logic error or state management issue within the InnoDB engine that triggers when processing specific malformed or complex queries via multiple network protocols. While the vulnerability requires high privileges and has a high complexity for exploitation, its successful execution results in severe availability impacts by causing the database server to hang or crash repeatedly.
From an operational perspective, this vulnerability poses a significant risk to environments where privileged users have network access to the MySQL service. Although the requirement for high-privileged authentication limits the attack surface compared to unauthenticated exploits, it does not eliminate the threat entirely within enterprise architectures where administrative accounts may be compromised through other vectors such as credential theft or insider threats. The primary impact is a complete denial of service, characterized by frequent and repeatable crashes that disrupt database availability. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically the resource exhaustion sub-technique, where an attacker aims to degrade or destroy the functionality of a system rather than exfiltrate data or modify it directly.
The CVSS 3.1 base score of 4.4 reflects the balance between the high availability impact and the restrictive prerequisites for exploitation. The vector string AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H indicates that while the attack can be launched over a network, it demands complex conditions to trigger and requires privileged access, resulting in no confidentiality or integrity loss but severe availability degradation. This scoring suggests that immediate emergency patching may not be as critical as for high-severity remote code execution flaws, yet it remains a priority for maintaining service level agreements and operational stability, particularly in clustered environments where node instability can lead to broader cluster failures.
Mitigation strategies should focus on strict access control policies to ensure that only essential administrative accounts have network-level connectivity to the MySQL instances. Implementing robust firewall rules to restrict inbound traffic from untrusted networks is a primary defense layer. Additionally, organizations must apply the latest security patches provided by Oracle for all affected versions listed in the advisory. Regular auditing of user privileges and monitoring database logs for unusual patterns that might indicate probing or exploitation attempts are recommended operational practices. Given the complexity required to exploit this flaw, maintaining up-to-date software versions remains the most effective technical control to prevent potential service disruptions caused by this specific InnoDB engine vulnerability.