This vulnerability exists in the Server: Optimizer component of Oracle MySQL Server and MySQL Cluster versions 9.7.0 to 9.7.1. It is easily exploitable by an attacker with low privileges and network access through multiple protocols. Successful exploitation results in an unauthorized denial of service condition by causing the server to hang or crash repeatedly. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Oracle has published this issue in their July 2026 Critical Patch Update advisory but has not explicitly stated a fix or patch for these versions in the provided advisory content.

The vulnerability allows an attacker with low privileges and network access to cause a complete denial of service on affected MySQL Server and MySQL Cluster versions 9.7.0 to 9.7.1. This results in the server hanging or crashing frequently, impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for MySQL Server versions 9.7.0 to 9.7.1. Users should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates promptly. Until a patch is confirmed and applied, consider restricting network access to MySQL services to trusted users only to reduce exposure.