CVE-2026-61128 in MySQL Cluster
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the optimizer component of MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.1, representing a significant availability risk that can be exploited by attackers with high privileges and network access. The flaw manifests as a condition where specific query patterns or optimization scenarios can trigger system instability leading to complete denial of service conditions. The vulnerability's exploitability is characterized as easily accessible due to the requirement of only high privileged access and network connectivity through multiple protocols, making it particularly concerning for environments where administrative accounts might be compromised or where network segmentation is inadequate.
The technical nature of this vulnerability stems from improper handling within the query optimizer module which processes SQL statements before execution. When certain complex queries are processed, the optimizer fails to properly validate input parameters or handle edge cases during the optimization phase, resulting in memory corruption or infinite loop conditions that cause system processes to hang or crash repeatedly. This behavior aligns with common software security vulnerabilities classified under CWE-248, which addresses "Exception Handling" issues where improper exception handling leads to system instability or crashes. The vulnerability's impact is specifically focused on availability as evidenced by the CVSS 3.1 base score of 4.9, with the availability impact rated as high (A:H) indicating that successful exploitation can result in complete system downtime.
The operational implications of this vulnerability extend beyond simple service disruption to potentially affect business continuity and data availability for critical applications relying on MySQL databases. Organizations utilizing affected versions may experience unexpected system outages during peak usage periods, leading to potential revenue loss and degraded user experience. The fact that this vulnerability affects both MySQL Server and MySQL Cluster components indicates the issue is fundamental to the core optimization logic rather than being isolated to specific deployment configurations. Attackers with elevated privileges can leverage this weakness to repeatedly crash database services, creating sustained denial of service conditions without requiring additional privileges or complex attack vectors.
Mitigation strategies should focus on immediate patching of affected systems to version 9.7.2 or later where the optimizer flaw has been addressed. Organizations should also implement network segmentation and access controls to limit exposure of administrative accounts and reduce the attack surface. Monitoring systems should be enhanced to detect unusual patterns of database service restarts or crashes that might indicate exploitation attempts. Additionally, implementing query throttling mechanisms and restricting complex query execution can help minimize impact if exploitation occurs. The vulnerability demonstrates the importance of thorough testing during software updates particularly in optimization components where performance enhancements can introduce stability risks. According to ATT&CK framework category T1499, this vulnerability aligns with "Toggle Service" techniques as it enables attackers to disrupt services through system instability rather than traditional data exfiltration methods. Organizations should also consider implementing database activity monitoring to detect anomalous query patterns that might precede exploitation attempts and maintain comprehensive incident response procedures for handling denial of service conditions in database environments.