This vulnerability exists in the Server: Optimizer component of Oracle MySQL Server and MySQL Cluster versions 9.7.0 to 9.7.1. An attacker with low privileges and network access can exploit this flaw to cause the MySQL Server or Cluster to hang or crash repeatedly, resulting in a complete denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory references this issue but does not explicitly confirm a patch or fix status for these affected versions.

Successful exploitation results in denial of service by causing the MySQL Server or MySQL Cluster to hang or crash repeatedly. There is no impact on confidentiality or integrity. The availability impact is high, potentially disrupting database services for users relying on affected versions 9.7.0 and 9.7.1.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation status for MySQL Server versions 9.7.0-9.7.1. Therefore, patch status is not yet confirmed — users should monitor the Oracle advisory for updates and apply patches promptly once available. Until then, consider limiting network access to MySQL services to trusted users and networks to reduce exposure.