This vulnerability exists in the optimizer component of Oracle MySQL Server and is exploitable by a high privileged attacker with network access. Successful exploitation can cause the MySQL Server to hang or crash repeatedly, leading to a complete denial of service. The affected versions span multiple major MySQL releases, including 8.0.x, 8.4.x, and 9.x series. The CVSS 3.1 base score is 4.9, reflecting a medium severity with an impact limited to availability (no confidentiality or integrity impact). Oracle's April 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for it. Customers are urged to apply the Critical Patch Update promptly to mitigate this and other vulnerabilities.

The vulnerability allows a high privileged attacker with network access to cause a denial of service by hanging or crashing the MySQL Server. There is no impact on data confidentiality or integrity. This can disrupt database availability and potentially affect dependent applications or services relying on MySQL Server.

Oracle's April 2026 Critical Patch Update advisory includes security patches addressing this vulnerability among many others. Customers are strongly recommended to apply the April 2026 Critical Patch Update promptly to mitigate this issue. Since the advisory does not explicitly confirm a standalone patch, applying the full Critical Patch Update is the advised remediation. No alternative mitigations or workarounds are specified by the vendor.