CVE-2026-34276 is a vulnerability in the Group Replication Plugin component of Oracle MySQL Server. It affects multiple supported versions from 8.0.0 up to 9.6.0. The flaw allows an attacker with low privileges and network access to cause a hang or repeated crash of the MySQL Server, resulting in a denial of service condition. The CVSS 3.1 base score is 6.5, reflecting a medium severity with an impact limited to availability (no confidentiality or integrity impact). Oracle's April 2026 Critical Patch Update advisory lists this vulnerability among 481 security patches and provides patch availability documentation for affected MySQL Server versions. The advisory emphasizes the importance of applying these patches promptly to prevent exploitation.

Successful exploitation of this vulnerability results in a denial of service condition by causing the MySQL Server to hang or crash repeatedly. This impacts the availability of the MySQL Server but does not compromise confidentiality or integrity of data. There are no reported active exploits in the wild. The vulnerability requires low privilege and network access, making it relatively easy to exploit if unpatched.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Users should apply the relevant patches for their MySQL Server versions (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0) as documented in the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle strongly recommends applying these patches without delay to mitigate the risk. There is no indication that any temporary or alternative mitigations are available or recommended. Patch status is confirmed by the vendor advisory.