CVE-2026-101810 in MySQL Router
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the MySQL Router component of Oracle MySQL, specifically affecting version 26.7.0 and potentially other supported releases in that lineage. This security flaw is classified under the general routing functionality, indicating a weakness in how the router processes incoming connection requests or data packets before forwarding them to backend database instances. The core technical issue involves an improper handling of specific input sequences or protocol interactions that leads to resource exhaustion or state corruption within the application logic. Because MySQL Router operates as a lightweight proxy facilitating connections between client applications and MySQL servers, its stability is critical for maintaining continuous service availability in distributed database architectures.
The exploitability characteristics of this vulnerability are particularly concerning due to the lack of authentication requirements. An unauthenticated attacker with network access via multiple protocols can trigger the flaw remotely without needing valid credentials or user interaction. This aligns with Common Weakness Enumeration (CWE) categories such as CWE-20, which describes improper input validation, and potentially CWE-400 regarding resource exhaustion conditions. The attack vector is classified as Network-based with Low Attack Complexity, meaning that standard networking tools can be used to craft the malicious payload without specialized knowledge or complex setup procedures. This significantly lowers the barrier for entry, allowing a broader range of threat actors to attempt exploitation against exposed MySQL Router instances.
The operational impact of successfully exploiting this vulnerability centers on Availability, as indicated by the CVSS 3.1 Base Score of 7.5 and High availability impact rating. A successful attack results in an unauthorized ability to cause a hang or a frequently repeatable crash of the MySQL Router process. This constitutes a Denial of Service (DoS) condition where legitimate users are unable to establish connections to the backend databases through the router. In high-availability environments, such as those utilizing replication clusters or sharding strategies, the failure of the routing layer can lead to cascading failures across multiple database nodes if failover mechanisms do not immediately compensate for the lost connection path. The repetitive nature of the crash suggests that an attacker could sustain a persistent DoS attack with minimal effort, effectively disrupting business operations dependent on real-time data access.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK techniques related to Denial of Service and potentially Resource Hijacking if the resource consumption leads to broader system instability. The lack of authentication requirements places it in categories associated with unauthenticated remote attacks, emphasizing the risk for services exposed directly to public networks or less secure internal segments without proper access controls. Organizations relying on MySQL Router must recognize that even proxy layers are susceptible to application-layer vulnerabilities that can disrupt service continuity just as severely as direct database compromises.
Mitigation strategies should prioritize immediate patching of the MySQL Router software to the latest stable version released by Oracle, which addresses the underlying input validation flaws. In environments where upgrading is not immediately feasible, network-level controls such as firewall rules or Web Application Firewalls (WAF) can be configured to restrict access to the router ports only from trusted IP ranges, thereby reducing the attack surface for unauthenticated actors. Additionally, implementing rate limiting on incoming connections can help mitigate the impact of repetitive crash attempts by throttling excessive traffic that may trigger the vulnerability. Monitoring logs for unusual patterns of connection failures or process restarts is also recommended to detect potential exploitation attempts early and respond before service disruption occurs.