This vulnerability (CVE-2026-61108) affects Oracle MySQL Server and MySQL Cluster components related to GIS in versions 9.7.0 to 9.7.1. It allows an attacker with low privileges and network access to cause a hang or repeated crash of the MySQL Server, resulting in a denial of service condition. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for these versions. No known exploits in the wild have been reported.

Successful exploitation results in denial of service by causing the MySQL Server or MySQL Cluster to hang or crash repeatedly, impacting availability. There is no impact on confidentiality or integrity. The attack requires network access and low privileges, making it relatively easy to exploit within the given constraints.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability but does not explicitly confirm patch availability or remediation level for affected versions 9.7.0 to 9.7.1. Customers are strongly advised to review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates promptly. Until a patch is confirmed, consider restricting network access to the MySQL Server and monitoring for unusual service disruptions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.