This vulnerability exists in the Optimizer component of Oracle MySQL Server and can be exploited by an attacker with high privileges and network access to cause a denial of service by hanging or repeatedly crashing the server. It affects multiple supported versions of MySQL Server. The CVSS 3.1 base score is 4.9, reflecting a medium severity primarily due to availability impact. Oracle's April 2026 Critical Patch Update includes patches addressing this vulnerability among many others. The vendor strongly recommends applying these patches promptly to mitigate the risk.

Successful exploitation results in denial of service conditions, causing the MySQL Server to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability requires a high privileged attacker with network access, limiting the attack surface to trusted or compromised users with elevated permissions.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Customers should apply the April 2026 CPU patches to affected MySQL Server versions without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory. There are no indications that the vulnerability is already mitigated or requires no action.