CVE-2026-101789 in MySQL Server
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the query optimizer component of Oracle MySQL Server and MySQL Cluster products, representing a significant availability risk for database infrastructure relying on these systems. The affected software versions span multiple release branches, including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster editions ranging from version 8.0 up to 8.0.49 and the same newer branches listed for the server component. This broad scope indicates that the flaw is not isolated to a single feature set but affects core optimization logic used during query execution planning across diverse deployment configurations. The vulnerability allows an attacker with low privileges who possesses network access via multiple protocols, such as TCP/IP or other supported database connection interfaces, to trigger a denial of service condition against the target MySQL instance.
From a technical perspective, the root cause lies in how the optimizer processes specific malformed or complex query structures that lead to resource exhaustion or infinite loops within its internal logic. When an attacker submits crafted input through any of the accessible network protocols, the server fails to handle the edge case correctly, resulting in either a hang where the process becomes unresponsive or a repeatable crash that forces the service to restart. This behavior aligns with Common Weakness Enumeration category CWE-400, which describes conditions related to resource exhaustion, and specifically maps to ATT&CK technique T1499, Endpoint Denial of Service, as it involves leveraging software vulnerabilities to disrupt normal operations. The impact is strictly on availability, meaning that while data integrity and confidentiality remain theoretically intact during the attack vector described, the operational continuity of database services is severely compromised.
The exploitation difficulty is rated as low due to the requirement for only low-privileged access rather than administrative credentials, combined with straightforward network accessibility. This lowers the barrier for entry significantly compared to vulnerabilities requiring high-level privileges or complex user interaction scenarios. The CVSS 3.1 base score of 6.5 reflects this balance between ease of exploitation and severe impact on availability. Attackers can potentially automate repeated attempts to crash the service, leading to persistent downtime unless mitigated by external controls such as rate limiting or connection throttling at the network perimeter.
Mitigation strategies must prioritize immediate patching for all affected versions listed in the advisory. Organizations should verify their current MySQL Server and Cluster versions against the specified ranges and apply the latest security updates provided by Oracle immediately. In environments where patching cannot be performed instantly, implementing strict access control lists to restrict database port exposure to only trusted IP addresses can reduce the attack surface. Additionally, deploying Web Application Firewalls or Database Activity Monitoring systems capable of detecting anomalous query patterns may help identify and block exploitation attempts before they trigger the denial-of-service condition. Regular auditing of user privileges is also recommended to ensure that no unnecessary low-privileged accounts have broad network access capabilities that could be leveraged for such attacks.