CVE-2026-101679 in MySQL Server
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the client programs component of Oracle MySQL Server and MySQL Cluster products, affecting a broad range of supported versions including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster releases from version 8.0 up to 8.0.49 and the same newer branches. This flaw represents a significant security risk due to its high exploitability characteristics, specifically allowing unauthenticated attackers with network access via multiple protocols to compromise the integrity of the database service environment. The core technical issue stems from improper handling or validation within the client-side processing logic that interacts directly with server resources, creating an entry point for malicious actors who do not require valid credentials to initiate their attack vectors.
From a technical perspective, this vulnerability is classified under CWE-20 Improper Input Validation and aligns with MITRE ATT&CK technique T1498 Network Denial of Service, as the primary outcome of exploitation is the disruption of service availability rather than data exfiltration or privilege escalation. The attacker can leverage multiple network protocols to send malformed or excessively resource-intensive requests that trigger internal errors within the MySQL client libraries or their interaction with the server stack. These errors manifest as hangs or frequently repeatable crashes, leading to a complete denial of service where the MySQL Server or Cluster becomes unresponsive and requires manual intervention or restart to restore functionality. The CVSS 3.1 base score of 7.5 reflects this high availability impact, emphasizing that while confidentiality and integrity remain unaffected in typical exploitation scenarios, the operational continuity is severely compromised.
The operational impact of such a vulnerability extends beyond simple downtime; it introduces significant risks to business continuity and data consistency depending on the cluster configuration. In MySQL Cluster environments, where multiple nodes rely on synchronized state information, repeated crashes can lead to split-brain scenarios or inconsistent data states across the cluster if not properly managed by automated failover mechanisms. Furthermore, because the vulnerability allows for repeatable crashes, it enables persistent denial of service attacks that can be sustained over time, potentially masking other malicious activities such as lateral movement within a network where database services are critical infrastructure components. The lack of authentication requirement means that any host with network connectivity to the MySQL ports is theoretically vulnerable, expanding the attack surface significantly in public-facing or poorly segmented internal networks.
Mitigation strategies must focus on immediate patching and architectural hardening. Organizations should prioritize upgrading affected MySQL Server and Cluster installations to versions where this vulnerability has been resolved by Oracle, ensuring that all client programs are updated alongside server components to maintain compatibility and security posture. In environments where immediate patching is not feasible due to operational constraints, network-level controls such as firewall rules or intrusion prevention systems can be configured to restrict access to MySQL ports from untrusted networks, effectively limiting the attack surface for unauthenticated actors. Additionally, implementing rate-limiting on database connections and monitoring for abnormal spikes in connection attempts or resource consumption can help detect ongoing exploitation attempts early. Regular security audits and penetration testing should also include specific checks against client-side vulnerabilities to ensure that assumptions about internal network trust do not lead to overlooked exposure vectors.