This vulnerability in Oracle MySQL Shell (component: Shell: Core Client) permits a low privileged attacker who has logged on to the system running MySQL Shell to cause a hang or repeated crash, resulting in a complete denial of service. Exploitation requires user interaction from a third party. The affected versions include 8.0.0 to 8.0.45, 8.4.0 to 8.4.8, and 9.0.0 to 9.6.0. The CVSS 3.1 base score is 5.0, reflecting a medium severity with an impact limited to availability (no confidentiality or integrity impact). The attack vector is local (AV:L), with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The vulnerability scope is unchanged (S:U). Oracle's April 2026 Critical Patch Update advisory references MySQL Shell among many other products but does not explicitly state a dedicated patch or fix for this vulnerability in the provided content.

Successful exploitation results in unauthorized denial of service by causing MySQL Shell to hang or crash repeatedly. This disrupts availability of MySQL Shell but does not compromise confidentiality or integrity of data. The attack requires local access with low privileges and user interaction from another person, limiting the ease of exploitation. No known exploits in the wild have been reported at this time.

Oracle's April 2026 Critical Patch Update advisory includes MySQL Shell in the list of affected products but does not explicitly confirm a patch or remediation for CVE-2026-34317 in the provided advisory content. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly when available. Until a patch is confirmed, limit local access to MySQL Shell infrastructure and educate users to avoid interacting with untrusted inputs or prompts that could trigger this vulnerability.