This vulnerability in Oracle MySQL Router (component: Router: General) affects versions 8.4.0-8.4.10 and 9.7.0-9.7.1. It allows an unauthenticated attacker with network access via HTTP to cause a hang or repeated crash, resulting in a complete denial of service (DoS). The CVSS 3.1 base score is 7.5, reflecting a high severity with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to availability. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory references MySQL Router among affected products but does not explicitly state patch availability or remediation instructions for this specific vulnerability.

Successful exploitation results in denial of service by causing MySQL Router to hang or crash repeatedly, impacting availability. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication or user interaction.

Oracle's July 2026 Critical Patch Update advisory includes MySQL Router among affected products but does not explicitly confirm patch availability or remediation for this vulnerability. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, consider restricting network access to MySQL Router's HTTP interface to trusted sources to reduce exposure.