CVE-2026-47052 in Server
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the InnoDB storage engine component of Oracle MySQL Server and MySQL Cluster products, representing a significant availability risk that affects multiple version ranges including MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The flaw manifests as a condition that can be exploited by high-privileged attackers who possess network access through various protocols, making it particularly concerning given the widespread use of MySQL in enterprise environments. The vulnerability's classification as easily exploitable indicates that attackers with minimal technical sophistication and appropriate privileges can leverage this weakness effectively.
The technical nature of this vulnerability involves a flaw in how InnoDB handles certain database operations that results in system instability leading to complete denial of service conditions. When successfully exploited, the vulnerability enables attackers to either cause the MySQL server or cluster to hang indefinitely or experience frequently repeatable crashes, effectively rendering the database service unavailable to legitimate users and applications. This type of flaw falls under CWE-476 which specifically addresses NULL pointer dereferences and similar memory access violations that can lead to system instability and availability compromise.
From an operational impact perspective, this vulnerability creates a severe disruption risk for organizations relying on MySQL databases as critical infrastructure components. The availability impact score of 4.9 within the CVSS 3.1 framework indicates that successful exploitation can result in complete system downtime, potentially affecting business continuity and data accessibility. Organizations with high-privileged database users or those with exposed MySQL instances over networks are particularly vulnerable to this attack vector. The fact that the vulnerability requires only high privileges combined with network access means that internal threats or compromised accounts with elevated permissions could easily exploit this weakness.
The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) clearly demonstrates the attack characteristics where network accessibility (AV:N) combined with low attack complexity (AC:L) and high privilege requirements (PR:H) creates a dangerous combination. The unspecified scope (S:U) indicates that the impact affects the target system without affecting other systems, while the absence of confidentiality or integrity impacts shows this vulnerability specifically targets availability through denial of service mechanisms. This aligns with ATT&CK technique T1499 which covers Network Denial of Service attacks and represents a critical weakness in database security management.
Organizations should implement immediate mitigation strategies including applying the latest security patches from Oracle, restricting network access to MySQL instances, implementing proper privilege controls, and monitoring for abnormal database behavior or connection patterns. Database administrators should also consider deploying intrusion detection systems that can identify suspicious access patterns and network traffic associated with potential exploitation attempts. Regular security assessments of database environments are essential to identify similar vulnerabilities and ensure comprehensive protection against both external and internal threats targeting critical database infrastructure components.