This vulnerability in the Server: JSON component of Oracle MySQL Server and MySQL Cluster (versions 9.7.0-9.7.1) allows an attacker with low privileges and network access to cause a denial of service by hanging or crashing the server. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory lists affected products and versions but does not explicitly state a patch or remediation level for this specific vulnerability. Customers are urged to apply available patches promptly, but patch status for this CVE is not explicitly confirmed in the advisory.

Successful exploitation allows an attacker with low privileges and network access to cause a hang or repeated crash of MySQL Server or MySQL Cluster, resulting in a complete denial of service. There is no impact on confidentiality or integrity. The availability impact is high, as indicated by the CVSS score and vector.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay on actively-supported versions. No specific temporary mitigations or workarounds are provided in the advisory.