This vulnerability exists in the InnoDB component of Oracle MySQL Server across multiple supported versions. It allows an attacker with high privileges and network access to cause the MySQL Server to hang or crash repeatedly, resulting in a complete denial of service. The CVSS vector indicates network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, no impact on confidentiality or integrity, and high impact on availability. Oracle has addressed this vulnerability in its April 2026 Critical Patch Update, which includes security patches for MySQL Server and related products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation results in denial of service by causing the MySQL Server to hang or crash repeatedly. There is no impact on data confidentiality or integrity. The vulnerability requires a high privileged attacker with network access, limiting the attack surface to authorized users or compromised accounts. No known active exploits have been reported.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Users should apply the relevant patches for their MySQL Server versions promptly. Oracle strongly recommends remaining on actively supported versions and applying Critical Patch Updates without delay. Patch status is confirmed as available via the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. No additional mitigation steps are indicated by the vendor advisory.