This vulnerability exists in the Optimizer component of Oracle MySQL Server and affects multiple supported versions. It allows an attacker with high privileges and network access to cause a denial of service by hanging or crashing the MySQL Server. The CVSS vector indicates network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is tracked as CWE-400 (Uncontrolled Resource Consumption). Oracle's April 2026 Critical Patch Update advisory lists affected MySQL Server versions but does not explicitly state patch availability or remediation level for this specific vulnerability.

Successful exploitation results in denial of service conditions by causing the MySQL Server to hang or crash repeatedly. There is no impact on data confidentiality or integrity. The attack requires high privileges and network access, limiting the attack surface to privileged users. No known exploits are currently reported in the wild.

Oracle's April 2026 Critical Patch Update advisory includes security patches for MySQL Server versions affected by this vulnerability. Customers are strongly advised to apply the latest Critical Patch Update promptly to mitigate this and other vulnerabilities. Since the vendor advisory does not explicitly confirm a specific patch for CVE-2026-22005, users should monitor Oracle's security alerts and apply updates as they become available. No alternative mitigations or workarounds are provided in the advisory.