CVE-2026-101788 in MySQL Server
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Server Components Services module of Oracle MySQL and its associated Cluster product, affecting a broad range of supported versions including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster releases from version 8.0 up to 8.0.49 alongside the newer series. This flaw is characterized by a difficult-to-exploit nature that nonetheless permits unauthenticated attackers with network access via multiple protocols to compromise the integrity of the database service infrastructure. The core technical issue stems from improper handling or validation within the server components, which allows an external actor to trigger conditions leading to severe operational instability. While the complexity of exploitation serves as a natural deterrent for opportunistic threats, it does not eliminate the risk posed by determined adversaries capable of crafting specific network payloads designed to exploit this logic error in the service layer.
The primary impact of successfully exploiting this vulnerability is a complete denial of service against the MySQL Server or Cluster environment. Attackers can induce hangs or cause frequently repeatable crashes that effectively render the database unavailable to legitimate users and applications relying on it for data storage, retrieval, and transaction processing. This aligns with the CVSS 3.1 base score of 5.9, which categorizes the severity as medium based primarily on high availability impact while noting no direct compromise of confidentiality or integrity in this specific vector. The attack is classified under CWE-400, Uncontrolled Resource Consumption, specifically manifesting as a resource exhaustion scenario where the server's processing capabilities are overwhelmed by malicious requests. From an offensive security perspective, such behavior maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, which involves overwhelming or flooding resources to disrupt availability rather than stealing data or altering configurations.
Mitigation strategies must focus on reducing the attack surface and enhancing monitoring capabilities since patching remains the most effective long-term solution for affected version ranges. Organizations should immediately apply the latest security updates provided by Oracle for their specific MySQL versions to resolve the underlying code flaws in the Server Components Services module. In environments where immediate patching is not feasible due to operational constraints, network-level controls such as firewalls or intrusion prevention systems can be configured to restrict access to database ports from untrusted networks and limit connection rates to mitigate potential flooding attempts. Additionally, implementing strict input validation at application proxies before requests reach the database layer can help filter out malformed packets that might trigger the vulnerability. Continuous monitoring of server logs for unusual patterns indicating repeated crashes or hang events is essential for early detection and rapid incident response in case an exploitation attempt occurs despite preventive measures.