This vulnerability exists in the Server: Optimizer component of Oracle MySQL Server and MySQL Cluster. It is exploitable by an attacker with high privileges and network access through multiple protocols. Successful exploitation leads to an unauthorized ability to cause the MySQL Server or Cluster to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 base score is 4.9, reflecting a medium severity primarily due to availability impact. Affected versions explicitly include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory references patches addressing this and many other vulnerabilities, but no specific patch link or remediation level is provided for this CVE individually.

The vulnerability allows a high privileged attacker with network access to cause a denial of service by hanging or crashing the MySQL Server or MySQL Cluster. There is no impact on confidentiality or integrity. This can disrupt database availability and potentially affect dependent applications or services relying on MySQL.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which provides cumulative patches for multiple vulnerabilities. Customers are strongly advised to apply the July 2026 Critical Patch Update promptly to remediate this issue. No separate or specific patch link is provided for this CVE, so refer to the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Until patches are applied, limiting network access to MySQL services and ensuring only trusted, high privileged users have network access may reduce risk.