This vulnerability affects Oracle MySQL Cluster versions 8.0.0 through 8.0.47 in the Server Optimizer component. It permits a high privileged attacker with network access to cause a hang or repeated crash of the MySQL Cluster, resulting in a complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among 1449 patches but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle emphasizes applying patches without delay to mitigate risks. No known exploits have been reported in the wild.

Successful exploitation allows a high privileged attacker with network access to cause a hang or frequent crash of the MySQL Cluster, resulting in a complete denial of service. There is no impact on confidentiality or integrity. The availability impact is high, but the overall CVSS score is medium (4.9) due to the required high privileges and no user interaction needed.

Oracle's advisory does not explicitly confirm the availability of a patch or official fix for this vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly once available to mitigate this and other vulnerabilities.