This vulnerability exists in the optimizer component of Oracle MySQL Server and affects multiple supported versions. It allows an attacker with high privileges and network access to cause the server to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 base score is 4.9, reflecting a medium severity with an impact limited to availability. The vulnerability does not compromise confidentiality or integrity. Oracle's April 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for it. The advisory emphasizes the importance of applying security patches promptly to avoid exploitation of known vulnerabilities.

Successful exploitation results in denial of service by causing the MySQL Server to hang or crash repeatedly. There is no impact on data confidentiality or integrity. The vulnerability requires a high privileged attacker with network access, limiting the attack surface to authorized users with elevated privileges. No known active exploits have been reported.

Oracle's April 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities, including those affecting MySQL Server. While the advisory does not explicitly confirm a patch specifically for CVE-2026-35240, customers are strongly advised to apply the latest Critical Patch Update without delay to mitigate this and other vulnerabilities. Since this is not a cloud service, remediation depends on customers applying patches to their MySQL Server installations. Monitor Oracle's advisory page for updated patch availability and installation instructions.