This vulnerability (CVE-2026-22002) exists in the optimizer component of Oracle MySQL Server. It is exploitable by a high privileged attacker with network access through multiple protocols. Successful exploitation leads to the ability to cause the MySQL Server to hang or crash repeatedly, resulting in a complete denial of service. The affected versions include MySQL Server 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The CVSS 3.1 base score is 4.9, reflecting a medium severity with an impact limited to availability. Oracle’s April 2026 Critical Patch Update advisory addresses this vulnerability among others, recommending patch application to mitigate the risk.

The impact of CVE-2026-22002 is a denial of service condition on affected MySQL Server instances. An attacker with high privileges and network access can cause the server to hang or crash repeatedly, disrupting database availability. There is no impact on confidentiality or integrity. No known active exploitation has been reported. The vulnerability affects multiple supported MySQL Server versions, potentially impacting organizations running these versions without applied patches.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Customers should promptly apply the April 2026 CPU to affected MySQL Server versions to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as available via the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html.