This vulnerability in the InnoDB component of Oracle MySQL Server allows an attacker with high privileges and network access to cause a denial of service by hanging or crashing the server. The affected versions span multiple major releases of MySQL Server. The CVSS 3.1 base score is 4.9, reflecting a medium severity with an impact limited to availability. Oracle's April 2026 Critical Patch Update includes fixes for this vulnerability among 481 security patches across many Oracle products. Customers are urged to apply the cumulative patches from this update to address the issue.

Successful exploitation results in denial of service by causing the MySQL Server to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability requires a high privileged attacker with network access, limiting the attack surface to authorized users or compromised accounts. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update in April 2026 that includes fixes for this vulnerability. Customers should apply the April 2026 Critical Patch Update promptly to remediate this issue. The vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html provides detailed patch availability and installation instructions. No alternative mitigations or temporary fixes are specified. Staying on actively supported versions and applying Oracle's cumulative security patches without delay is strongly recommended.