This vulnerability exists in the replication component of Oracle MySQL Server and MySQL Cluster. Versions affected include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, and MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. An unauthenticated attacker with logon access to the infrastructure can exploit this flaw to cause a hang or frequent crashes, leading to a complete denial of service. The CVSS vector indicates low attack complexity and no privileges required, with no impact on confidentiality or integrity but high impact on availability. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among 1449 security patches and provides patch availability documentation for affected products.

Successful exploitation results in denial of service by causing the MySQL Server or MySQL Cluster to hang or crash repeatedly. There is no impact on confidentiality or integrity. The vulnerability requires the attacker to have logon access to the infrastructure but no privileges within MySQL itself. The medium severity score reflects the significant availability impact but limited scope of exploitation.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users of affected MySQL Server and MySQL Cluster versions should apply the relevant patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.