CVE-2026-101721 in MySQL Server
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Components Services module of Oracle MySQL and its associated Cluster product, affecting a broad range of supported versions including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding releases of MySQL Cluster from version 8.0 up to 8.0.49 alongside the newer branches listed above. This flaw is classified under CWE-400, which denotes uncontrolled resource consumption leading to denial of service conditions. The technical nature of this vulnerability allows for an easily exploitable attack vector that requires high privileged access and network connectivity via multiple protocols to trigger a complete system hang or frequently repeatable crash. While the requirement for high privileges typically limits direct exploitation by external threat actors, it remains critical in environments where internal users possess elevated database roles or when combined with other privilege escalation vulnerabilities.
From an operational perspective, the impact of this vulnerability is strictly confined to availability, as indicated by a CVSS 3.1 Base Score of 4.9 and a vector string that specifies no impact on confidentiality or integrity but high impact on availability. Successful exploitation results in a complete denial of service against the MySQL Server or Cluster instance, rendering database services unavailable to legitimate users and applications dependent on them. This disruption can lead to significant business continuity issues, particularly in production environments where uptime is critical for transactional processing and data retrieval operations. The ability to cause repeatable crashes means that an attacker with sufficient access could potentially create a persistent denial of service condition by repeatedly triggering the flaw, thereby exhausting system resources or causing the database engine to enter a failed state requiring manual intervention to restore functionality.
In terms of threat modeling and industry standards, this vulnerability aligns with MITRE ATT&CK techniques related to Resource Hijacking and Denial of Service, specifically those involving application layer attacks that target service availability rather than data exfiltration or modification. The reliance on network access via multiple protocols suggests that the attack surface includes standard database communication channels such as TCP/IP connections used for client-server interactions. Security teams should assess whether any internal services or user accounts have been granted high-level privileges that could be leveraged to trigger this condition, especially in multi-tenant environments where privilege boundaries might not be strictly enforced at the application layer.
Mitigation strategies primarily involve applying the latest security patches provided by Oracle for the affected MySQL and MySQL Cluster versions. Organizations should prioritize updating their database infrastructure to a version outside of the specified vulnerable ranges to eliminate the root cause of the instability. In addition to patching, implementing strict access controls is essential; administrators must ensure that only authorized personnel with legitimate business needs are granted high-privilege accounts within the database environment. Network segmentation and firewall rules should be reviewed to restrict direct network access to database ports from untrusted networks, thereby reducing the attack surface even if internal privilege boundaries are compromised. Regular monitoring of system logs for signs of repeated connection attempts or service restarts can also help in detecting potential exploitation attempts early before a complete outage occurs.