This vulnerability exists in the Server: Optimizer component of Oracle MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1. It is easily exploitable by an attacker with low privileges and network access through multiple protocols. Successful exploitation results in an unauthorized ability to cause a hang or frequent crash of the MySQL Server or Cluster, leading to a complete denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the attack requires network access, low attack complexity, and low privileges, with no user interaction needed. The impact is limited to availability with no confidentiality or integrity loss. Oracle's July 2026 Critical Patch Update advisory lists affected MySQL versions overlapping with this vulnerability but does not explicitly state a fix for these versions or provide a remediation level. Patch status is therefore not confirmed and should be verified with Oracle's advisory.

The vulnerability allows an attacker with low privileges and network access to cause a denial of service by hanging or crashing the MySQL Server or MySQL Cluster. This results in unavailability of the database service but does not compromise data confidentiality or integrity. There are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, consider restricting network access to MySQL services to trusted users only to reduce exposure.