CVE-2026-61093 in MySQL Server
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the optimizer component of MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.1, representing a significant availability risk that can be exploited by low-privileged attackers with network access. The flaw manifests as a condition where malicious input or specific query patterns can trigger system instability leading to complete denial of service scenarios. The vulnerability's exploitability is rated as easily accessible due to the minimal privilege requirements and network-based attack vector, making it particularly dangerous in production environments where availability is critical. The CVSS 3.1 scoring framework assigns a base score of 6.5, with the availability impact category receiving the highest weight, reflecting the potential for complete system unavailability.
The technical nature of this vulnerability stems from improper handling of certain optimizer operations that can cause resource exhaustion or memory corruption when processing specific query structures. Attackers can craft malicious queries or leverage existing database operations to trigger the faulty code path within the optimizer module, resulting in either system hangs or repeated crashes that effectively render the database service unavailable. The affected components operate at the core execution layer of MySQL's query processing pipeline, making this flaw particularly impactful as it bypasses typical application-level protections and directly targets fundamental database functionality. This type of vulnerability is classified under CWE-476 which deals with null pointer dereferences or similar memory handling errors that can lead to system instability.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise entire database availability for extended periods. Organizations relying on MySQL Server or MySQL Cluster for critical business operations face significant risk of data access interruptions, application downtime, and potential revenue loss during exploitation periods. The repeated crash scenario particularly affects systems with automated monitoring that may not distinguish between legitimate failures and attack-induced instability, leading to unnecessary alerts and response efforts. Additionally, the vulnerability's presence in both MySQL Server and MySQL Cluster components creates a broader attack surface requiring coordinated patching efforts across multiple system types.
Mitigation strategies should prioritize immediate patch deployment for all affected versions, with rollback procedures established for environments where patch testing is required. Network segmentation and access control measures can help reduce the attack surface by limiting which systems can reach the database services directly. Implementing query monitoring and rate limiting can provide additional defense-in-depth layers to detect and prevent exploitation attempts before they cause system instability. Organizations should also establish robust incident response procedures specifically addressing availability-based attacks, including automated failover mechanisms and comprehensive backup restoration capabilities. The ATT&CK framework categorizes this vulnerability under the T1499.004 sub-technique for network denial of service attacks, emphasizing the importance of monitoring for unusual query patterns that might indicate exploitation attempts. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities in database configurations and ensure that all systems remain protected against evolving threat landscapes.