CVE-2026-46863 is a vulnerability in the connection handling component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0, as well as MySQL Cluster versions 8.0.11 through 8.0.46, 8.4.0 through 8.4.9, and 9.0.0 through 9.7.0. The flaw allows an unauthenticated attacker with network access via multiple protocols to cause a hang or repeated crash of the server, resulting in a complete denial of service. The CVSS 3.1 base score is 7.5, reflecting high severity due to availability impact. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for the affected MySQL versions. Oracle strongly recommends applying these patches without delay. Mitigations such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but can affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to cause a hang or frequent crash of MySQL Server or MySQL Cluster, resulting in a complete denial of service (DoS). There is no impact on confidentiality or integrity. The availability impact is rated high with a CVSS score of 7.5.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these security patches promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required by an attack or by removing unnecessary privileges from users, though these mitigations may disrupt application functionality. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay.