This vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML) allows a high privileged attacker with network access to cause a hang or frequent crash of the server, resulting in a complete denial of service. It affects multiple supported versions from 8.0.0 through 9.6.0. The CVSS 3.1 base score is 4.9, reflecting a medium severity with impact limited to availability (no confidentiality or integrity impact). The vulnerability is addressed in Oracle's April 2026 Critical Patch Update, which includes patches for MySQL Server among many other Oracle products. Oracle strongly recommends applying these patches promptly to mitigate the risk.

Successful exploitation results in denial of service by causing the MySQL Server to hang or crash repeatedly. This impacts the availability of the database service but does not compromise data confidentiality or integrity. No known exploits are reported in the wild, reducing immediate risk, but the vulnerability is easily exploitable by attackers with high privileges and network access.

Oracle has released security patches for this vulnerability as part of the April 2026 Critical Patch Update. Users should apply the April 2026 CPU patches to affected MySQL Server versions without delay. Oracle strongly recommends staying on actively supported versions and applying Critical Patch Updates promptly to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.