This vulnerability (CVE-2026-22017) resides in the Optimizer component of Oracle MySQL Server and allows an attacker with low privileges and network access to cause a denial of service by hanging or repeatedly crashing the server. The affected versions span multiple major releases of MySQL Server, including 8.0.x, 8.4.x, and 9.x series. The CVSS 3.1 base score is 6.5, reflecting a medium severity with an impact limited to availability (denial of service). Oracle's April 2026 Critical Patch Update includes security patches addressing this vulnerability among others. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability results in denial of service conditions on the MySQL Server, causing it to hang or crash repeatedly. This impacts the availability of the database service but does not compromise data confidentiality or integrity. There are no reports of active exploitation in the wild at the time of publication.

Oracle has released security patches for this vulnerability as part of the April 2026 Critical Patch Update. Users of affected MySQL Server versions (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0) should apply the relevant patches promptly. Oracle strongly advises customers to remain on actively-supported versions and to apply Critical Patch Updates without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. No alternative mitigations or workarounds are specified by Oracle.