This vulnerability in the InnoDB component of Oracle MySQL Server allows a high privileged attacker with network access to cause a hang or repeated crash of the server, resulting in a complete denial of service. Affected versions include 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The CVSS 3.1 base score is 4.9, reflecting a medium severity primarily due to availability impact. The vulnerability requires high privileges and network access but does not impact confidentiality or integrity. Oracle's April 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability for this specific issue. The advisory strongly recommends applying the Critical Patch Update to mitigate vulnerabilities.

Successful exploitation allows a high privileged attacker with network access to cause a hang or repeated crash of MySQL Server, resulting in a denial of service condition. There is no impact on data confidentiality or integrity. No known exploits in the wild have been reported. The impact is limited to availability disruption of the MySQL Server.

Oracle's April 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities in MySQL Server, including affected versions. Although the advisory does not explicitly confirm a patch for CVE-2026-35238, it strongly recommends that customers apply the April 2026 Critical Patch Update without delay to mitigate this and other vulnerabilities. Users should review the advisory and patch availability documentation linked therein to confirm and apply the relevant patches. Patch status is not yet explicitly confirmed for this CVE; therefore, check the vendor advisory for current remediation guidance.