This vulnerability exists in the Server: Optimizer component of Oracle MySQL Server and MySQL Cluster versions 9.7.0 to 9.7.1. It allows an attacker with low privileges and network access to cause a denial of service by hanging or crashing the server repeatedly. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no impact on confidentiality or integrity, and high impact on availability. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory references MySQL Cluster versions 9.7.0-9.7.1 among affected products but does not explicitly confirm patch availability or remediation status for this specific vulnerability in the provided excerpt.

Successful exploitation results in a denial of service condition by causing the MySQL Server or MySQL Cluster to hang or crash repeatedly. There is no impact on confidentiality or integrity of data. The attack requires network access and low privileges, making it relatively easy to exploit. The availability impact is high, but no data breach or unauthorized data modification is indicated.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed and applied, consider restricting network access to MySQL Server and Cluster instances to trusted users only to reduce exposure.