CVE-2026-46862 is a vulnerability in Oracle MySQL Router (component: Router: General) affecting versions 8.4.0-8.4.9 and 9.0.0-9.7.0. It allows an unauthenticated attacker with network access via TLS to cause a hang or repeated crash of MySQL Router, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting high severity due to availability impact. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for MySQL Router among other products. The vendor strongly recommends applying these patches without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via TLS to cause MySQL Router to hang or crash repeatedly, resulting in a complete denial of service. There is no impact on confidentiality or integrity. The availability impact can disrupt services relying on MySQL Router, potentially causing downtime or service interruptions.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these security patches as soon as possible to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack or by removing unnecessary privileges from users, though these mitigations may impact application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches promptly.