CVE-2026-101787 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the query optimizer component of Oracle MySQL Server and MySQL Cluster products, representing a significant reliability concern for database infrastructure relying on these systems. The affected software versions include MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding releases of MySQL Cluster ranging from 8.0 up to 8.0.49 and the same newer version ranges. This flaw is classified under CWE-400, which denotes uncontrolled resource consumption, specifically manifesting here as a denial of service condition triggered by specific query patterns that cause the optimizer to enter an inefficient or infinite loop state during execution planning.
Exploitation of this vulnerability requires a high privileged attacker with network access via multiple protocols, indicating that while remote exploitation is possible, it necessitates valid authentication credentials with elevated privileges within the database system. The attack vector allows for easy exploitability due to low complexity requirements once authenticated access is established. Upon successful execution, the flaw results in an unauthorized ability to cause a hang or frequently repeatable crash of the MySQL Server or Cluster processes. This leads to a complete denial of service where the database engine becomes unresponsive or terminates unexpectedly, disrupting all dependent applications and services that rely on continuous data availability.
From an operational perspective, this vulnerability impacts the availability pillar of information security as reflected in its CVSS 3.1 base score of 4.9. The vector string (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms that while confidentiality and integrity remain unaffected due to the lack of data exfiltration or modification capabilities, the availability impact is high. In enterprise environments where MySQL serves as a critical backend for transactional systems, web applications, or analytics platforms, such instability can lead to significant business disruption, SLA violations, and potential revenue loss during periods of unavailability.
Mitigation strategies should prioritize immediate patching to the latest stable release within each supported branch provided by Oracle, which addresses the optimizer logic flaws responsible for these resource exhaustion scenarios. In addition to software updates, administrators should enforce strict least-privilege principles to ensure that only essential services and users possess high-level administrative access, thereby reducing the attack surface available to potential insiders or compromised accounts. Implementing robust query monitoring tools can also help identify anomalous execution plans or prolonged optimizer phases before they trigger system instability, allowing for proactive intervention during incident response activities aligned with MITRE ATT&CK techniques related to resource hijacking and service disruption.