Oracle MySQL Server/MySQL Cluster up to 8.4.9/9.7.0 Connection denial of service

Summaryinfo

A vulnerability was found in Oracle MySQL Server and MySQL Cluster up to 8.4.9/9.7.0. It has been declared as problematic. This affects an unknown function of the component Connection Handler. Such manipulation leads to denial of service. This vulnerability is referenced as CVE-2026-46863. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Oracle MySQL Server and MySQL Cluster up to 8.4.9/9.7.0. Affected by this issue is some unknown processing of the component Connection Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The advisory is shared for download at oracle.com. This vulnerability is handled as CVE-2026-46863 since 05/18/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/17/2026). The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Database Software

Vendor

• Oracle

Name

• MySQL Cluster
• MySQL Server

Version

• 8.4.0
• 8.4.1
• 8.4.2
• 8.4.3
• 8.4.4
• 8.4.5
• 8.4.6
• 8.4.7
• 8.4.8
• 8.4.9
• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7.0

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion