CVE-2026-101617 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the InnoDB storage engine of Oracle MySQL Server and MySQL Cluster products, affecting specific version ranges including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster versions from 8.0 up to 8.0.49 and the same newer branches. This flaw represents a significant availability risk for organizations relying on these database systems for critical data operations. The vulnerability is characterized by its potential to cause complete denial of service through hang conditions or repeatable crashes, which effectively renders the database instance inaccessible to legitimate users and applications. Such instability can lead to substantial operational downtime, impacting business continuity and potentially causing data integrity issues if transactions are interrupted during a crash event without proper recovery mechanisms in place.
From a technical perspective, this vulnerability is exploitable by an attacker who possesses high privileges within the MySQL environment but does not require user interaction or complex social engineering tactics. The attack vector allows for network-based exploitation via multiple protocols, indicating that the flaw may be triggered through various standard database communication channels rather than being limited to a single interface. This broad accessibility increases the surface area of potential attacks, although it is mitigated by the requirement for high-privileged access. An attacker with such privileges typically has significant control over the system already, but this vulnerability allows them to escalate their impact from mere data manipulation or privilege abuse to complete service disruption. The ability to cause a hang or crash repeatedly suggests that the flaw likely involves resource exhaustion, memory corruption, or an unhandled exception in the InnoDB engine's processing logic when encountering specific malformed queries or internal states triggered by authenticated high-level users.
The operational impact of this vulnerability is primarily centered on availability, as reflected in its CVSS 3.1 base score of 4.9 with a vector indicating network accessibility, low attack complexity, no user interaction required, and high availability impact while maintaining zero confidentiality or integrity impacts for unprivileged attackers. This classification aligns with CWE-617, which describes the Reachable Assertion vulnerability type where an assertion failure leads to application termination or hang. In the context of database servers, such failures are particularly severe because they disrupt all connected clients simultaneously. For MySQL Cluster environments, this can also impact distributed consistency and node coordination if a critical management or data node crashes unexpectedly. The repeatable nature of the crash means that once identified by an attacker with sufficient privileges, it can be used as a persistent tool for denial-of-service attacks against specific database instances within a larger infrastructure.
Mitigation strategies must focus on both immediate patching and long-term architectural controls. Oracle has released updates to address this issue in the affected version ranges, making the primary remediation step the application of these security patches to all supported MySQL Server and Cluster installations. Organizations should prioritize updating systems running versions 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1 for both server and cluster components. Beyond patching, it is crucial to enforce strict principle of least privilege within the database environment. Since exploitation requires high privileged access, ensuring that application accounts do not operate with administrative or superuser rights significantly reduces the risk of this vulnerability being triggered. Implementing robust monitoring solutions can also help detect unusual patterns of connection attempts or query executions from high-privilege accounts that might indicate an attempt to exploit this flaw. Additionally, configuring automatic restart policies for database services can mitigate some availability impacts by restoring service quickly after a crash, though this does not address the root cause and should be viewed as a compensating control rather than a fix.