This vulnerability in Oracle MySQL Server's DML component allows a high privileged attacker with network access to cause a hang or repeated crash, resulting in a denial of service condition. Affected versions include 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no impact on confidentiality or integrity, and high impact on availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's April 2026 Critical Patch Update advisory references MySQL Server among affected products but does not explicitly state patch availability or remediation details for this specific CVE. No known exploits have been reported in the wild.

Successful exploitation allows a high privileged attacker with network access to cause a hang or frequent crash of the MySQL Server, resulting in a complete denial of service. There is no impact on confidentiality or integrity of data. The medium severity score reflects the availability impact without data compromise. No known active exploitation has been reported.

Oracle's April 2026 Critical Patch Update advisory includes MySQL Server among affected products and strongly recommends applying the update promptly. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-35239. Organizations should monitor Oracle's security advisories for patch release information and apply Critical Patch Updates as soon as they become available. Until a patch is confirmed, no additional vendor-recommended mitigations are specified.