CVE-2026-101620 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3; MySQL Cluster: 9.7.0-9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the query optimizer component of Oracle MySQL Server and MySQL Cluster, specifically affecting versions 9.7.0 through 9.7.3. The query optimizer is a critical subsystem responsible for determining the most efficient execution plan for SQL statements by analyzing available indexes, table statistics, and join strategies. A flaw in this logic allows an attacker to construct specific malformed or complex queries that trigger internal errors within the optimization process rather than during data retrieval or storage operations. This architectural placement means the vulnerability is triggered at a high level of abstraction before actual execution begins, making it distinct from typical injection flaws that target parsing or runtime engine layers.
Exploitation requires low-privileged network access via multiple protocols supported by MySQL Server, such as TCP/IP connections using standard client libraries or command-line interfaces. The attacker does not need administrative privileges to trigger the condition, significantly lowering the barrier for entry in environments where application-level database accounts are granted minimal permissions but retain the ability to execute arbitrary queries against accessible schemas. Once a malicious query is submitted, it causes the server process to enter an unrecoverable state characterized by hanging or frequent repetition of crashes leading to complete denial of service conditions. This impact directly affects the availability pillar of information security as defined in standard risk assessment frameworks.
From a technical classification perspective, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption and potentially CWE-756 Missing or Incorrect Canonicalization depending on how the malformed input is processed by the optimizer's heuristic algorithms. The ability to cause a hang or crash through specific query structures indicates that the software fails to properly validate resource allocation limits or handle edge cases in logical plan generation, leading to infinite loops or memory corruption within the optimization thread. This behavior mirrors patterns observed in ATT&CK technique T1499 Endpoint Denial of Service where an adversary leverages application-level vulnerabilities to disrupt service availability without necessarily compromising data integrity or confidentiality at this stage.
The operational impact is severe for production environments relying on high availability architectures, particularly those using MySQL Cluster which depends on consistent node communication and state synchronization. A denial of service event in a clustered environment can lead to cascading failures if the cluster manager interprets repeated crashes as node unavailability, potentially triggering unnecessary failovers or split-brain scenarios depending on configuration settings. Even in standalone deployments, the inability to serve requests disrupts business continuity for applications dependent on real-time data access, causing timeouts and user-facing errors that degrade service quality significantly until the server process is manually restarted by an administrator.
Mitigation strategies must prioritize immediate patching of all affected instances running versions 9.7.0 through 9.7.3 to Oracle’s latest stable release where this optimizer logic has been corrected. In scenarios where immediate patching is not feasible, network-level controls should be implemented to restrict direct database port access to only trusted application servers and management networks using firewall rules or security groups. Additionally, deploying a Web Application Firewall with SQL injection detection capabilities may help filter out suspicious query patterns that resemble the exploit vectors for this vulnerability before they reach the MySQL optimizer layer. Database administrators should also audit existing user privileges to ensure no unnecessary broad permissions are granted to low-privileged accounts and monitor server logs for repeated connection drops or error messages indicative of optimization failures.