CVE-2026-34271 is a denial-of-service vulnerability in the Group Replication Plugin component of Oracle MySQL Server. It affects multiple supported versions ranging from 8.0.0 to 9.6.0. The flaw allows an attacker with low privileges and network access to cause the server to hang or crash repeatedly, resulting in a complete denial of service. The vulnerability has a CVSS 3.1 score of 6.5 with an attack vector of network, low attack complexity, and no user interaction required. Oracle's April 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for this specific issue. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability results in a denial of service condition by causing the MySQL Server to hang or crash repeatedly. This impacts the availability of the database service but does not compromise confidentiality or integrity of data. The vulnerability can be exploited by an attacker with low privileges and network access via multiple protocols. There are no reports of active exploitation in the wild at this time.

Oracle's April 2026 Critical Patch Update advisory includes security patches for MySQL Server and related products. Customers are strongly recommended to apply the latest Critical Patch Update promptly to address this and other vulnerabilities. The advisory does not explicitly confirm a dedicated patch for CVE-2026-34271, so patch status is not yet confirmed. Users should monitor Oracle's security advisories for updates on patch availability and apply patches as soon as they are released. No vendor guidance indicates that no action is required or that the issue is already mitigated.