This vulnerability exists in the Group Replication Plugin component of Oracle MySQL Server. It allows an attacker with low privileges and network access to cause a hang or frequent crash of the MySQL Server, resulting in a denial of service condition. The CVSS 3.1 base score is 6.5, reflecting a medium severity primarily due to availability impact. The affected versions span multiple major releases of MySQL Server, including 8.0.x, 8.4.x, and 9.x series. Oracle has addressed this vulnerability in its April 2026 Critical Patch Update, which includes security patches for MySQL Server among other products. The vendor strongly recommends applying these patches promptly to prevent exploitation.

Successful exploitation results in denial of service by causing the MySQL Server to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely by an attacker with low privileges and network access via multiple protocols. No known exploits have been reported in the wild.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Users of affected MySQL Server versions should apply the April 2026 CPU patches without delay to remediate this issue. Oracle strongly recommends staying on actively supported versions and promptly applying all Critical Patch Updates. Patch status is confirmed as available via the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html.