This vulnerability exists in the Server: Optimizer component of Oracle MySQL Server and MySQL Cluster. A low privileged attacker with network access can exploit this flaw via multiple protocols to cause a hang or frequent crashes, leading to a complete denial of service. Affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no impact on confidentiality or integrity, and high impact on availability. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability and provides patch availability documentation for affected products.

Successful exploitation allows an attacker with low privileges and network access to cause a hang or repeated crash of MySQL Server or MySQL Cluster, resulting in a denial of service condition. There is no impact on confidentiality or integrity. The availability impact is high, reflected in the CVSS score of 6.5. No known exploits in the wild have been reported at this time.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should apply the relevant patches promptly to affected MySQL Server and MySQL Cluster versions. The vendor advisory strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html.