CVE-2026-101801 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the query optimizer component of Oracle MySQL Server and MySQL Cluster products, representing a significant reliability risk for database infrastructure relying on these systems. The affected software versions include MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding releases of MySQL Cluster ranging from 8.0 up to 8.0.49 and the same newer version ranges. This specific flaw is categorized under CWE-400, which denotes uncontrolled resource consumption, specifically manifesting in a manner that leads to denial of service conditions rather than data integrity or confidentiality breaches. The vulnerability stems from how the optimizer handles certain complex query structures or execution plans, where improper handling can cause the server process to enter an unrecoverable state characterized by hanging or repeated crashes.
Exploitation of this vulnerability requires a high-privileged attacker who possesses network access via multiple protocols supported by MySQL, such as TCP/IP. The requirement for high privileges indicates that the attack vector is not open to unauthenticated users but targets authenticated database administrators or application accounts with elevated permissions. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an attacker leverages specific system behaviors to exhaust resources and disrupt service availability. The CVSS 3.1 base score of 4.9 reflects a medium severity rating driven primarily by the high impact on availability while maintaining no direct impact on confidentiality or integrity. The vector string AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H confirms that the attack is network-based, requires low complexity to execute once authenticated, and results in complete loss of service without affecting other security properties.
The operational impact of this vulnerability is severe for production environments where high availability is critical. A successful exploit allows an attacker with sufficient privileges to trigger a hang or cause frequent, repeatable crashes of the MySQL Server or Cluster nodes. This denial of service condition effectively renders the database unavailable to legitimate users and applications, leading to potential business disruption, data processing delays, and loss of trust in the system's reliability. In clustered environments, this can also lead to cascading failures if not properly isolated, potentially affecting dependent services that rely on consistent database connectivity. The ability to cause a complete denial of service through simple query submission highlights a critical weakness in input validation or resource management within the optimizer logic.
Mitigation strategies should focus primarily on applying the latest security patches provided by Oracle for all affected versions listed above. Organizations must ensure their patching cycles are agile enough to address such availability-focused vulnerabilities promptly, as they can be exploited during periods of high traffic when system stability is most crucial. Additionally, implementing strict access controls and principle of least privilege can reduce the attack surface by ensuring that only essential accounts have database administrator privileges. Network segmentation and firewall rules should also be reviewed to limit direct network access to MySQL ports from untrusted networks, although this vulnerability specifically targets authenticated users with high privileges. Regular auditing of user permissions and monitoring for unusual query patterns or resource spikes can help in early detection of exploitation attempts before a full denial of service occurs.