CVE-2026-35239 in MySQL Server
Summary
by MITRE • 04/22/2026
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability resides within the MySQL Server's DML component and affects multiple version ranges including 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. The flaw represents a significant security concern as it can be exploited by attackers with high privileges who possess network access through various protocols. The vulnerability's classification as easily exploitable indicates that the attack surface is relatively broad and accessible to determined adversaries. According to CVSS 3.1 scoring methodology, this vulnerability carries a base score of 4.9 which reflects a medium severity level, though the availability impact component scores highest at 7.5, indicating substantial risk to system uptime and service availability.
The technical nature of this flaw manifests as an ability for authenticated attackers with elevated privileges to cause complete denial of service conditions within the MySQL Server environment. When successfully exploited, the vulnerability enables attackers to either hang the server or trigger frequently repeatable crashes that can lead to sustained unavailability of database services. This specific type of vulnerability typically stems from improper input validation or handling of malformed data structures within the DML processing engine, which is responsible for executing data manipulation language operations such as insertions, updates, and deletions. The attack vector requires network access and assumes a high-privilege attacker context, suggesting that the vulnerability may be exploitable through administrative accounts or processes with elevated database permissions.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise entire database infrastructure availability. Organizations relying on MySQL Server for critical business operations face significant risk of service interruptions that could cascade into broader business continuity issues. The complete denial of service condition means that legitimate database users cannot access their data services, potentially leading to financial losses, operational delays, and reputational damage. From an attack perspective, this vulnerability aligns with ATT&CK technique T1499.004 which covers network denial of service, and potentially relates to CWE-121 which addresses buffer overflow conditions in data handling operations.
Mitigation strategies should prioritize immediate patching of affected versions according to Oracle's security advisories, as this represents a critical availability threat that can be exploited by privileged attackers. Organizations should also implement network segmentation and access controls to limit exposure of database servers to only authorized administrative networks. Monitoring systems should be enhanced to detect unusual patterns of database server crashes or hangs that might indicate exploitation attempts. Additionally, implementing proper privilege management and least-privilege principles can reduce the impact of successful exploitation attempts. According to industry best practices for vulnerability management, organizations should also establish incident response procedures specifically addressing denial of service conditions in database environments, ensuring rapid containment and recovery measures are available when such attacks occur.