This vulnerability (CVE-2026-60187) exists in the replication component of Oracle MySQL Server and MySQL Cluster. It allows a high privileged attacker with network access via multiple protocols to cause a hang or frequent crashes, resulting in a complete denial of service. The CVSS 3.1 base score is 4.4, reflecting an availability impact only, with attack vector network, high attack complexity, and requiring high privileges. The affected versions are MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory includes patches addressing this vulnerability among many others.

Successful exploitation results in unauthorized ability to cause a hang or repeated crash of MySQL Server or MySQL Cluster, leading to a denial of service condition. There is no impact on confidentiality or integrity. The attack requires high privileges and network access, and is difficult to exploit.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should apply the relevant patches promptly to remediate this issue. There is no indication that the vulnerability is mitigated by default or that no action is required. Patch status is confirmed by the vendor advisory. No additional mitigations beyond patching are specified.