CVE-2026-46863 is a vulnerability in the connection handling component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0, as well as MySQL Cluster versions 8.0.11 through 8.0.46, 8.4.0 through 8.4.9, and 9.0.0 through 9.7.0. The flaw allows an unauthenticated attacker with network access via multiple protocols to cause a hang or frequent crash of the server, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting a high severity focused on availability impact. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for the affected MySQL versions. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability allows an unauthenticated attacker to cause a hang or repeated crash of MySQL Server or MySQL Cluster, resulting in a complete denial of service. There is no impact on confidentiality or integrity. The availability impact is significant, potentially disrupting database services and applications relying on MySQL.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.