CVE-2026-34270 is a medium severity vulnerability in the Group Replication Plugin component of Oracle MySQL Server. It affects multiple supported versions and allows an attacker with low privileges and network access to cause a denial of service by hanging or crashing the MySQL Server. The CVSS 3.1 base score is 6.5, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impacting availability only. Oracle has addressed this vulnerability in its April 2026 Critical Patch Update, which includes patches for affected MySQL Server versions. The vendor strongly recommends applying these patches promptly to mitigate the risk.

Successful exploitation of this vulnerability results in denial of service by causing the MySQL Server to hang or crash repeatedly. This impacts the availability of the database service but does not compromise confidentiality or integrity of data. There are no reports of active exploitation in the wild at this time.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Customers should apply the April 2026 CPU promptly to affected MySQL Server versions (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0) to remediate this issue. Oracle strongly recommends staying on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html.