This vulnerability (CVE-2026-61109) exists in the JSON component of Oracle MySQL Server and MySQL Cluster. It is easily exploitable by a low privileged attacker with network access through multiple protocols. Successful exploitation results in the ability to cause a hang or frequent crash of the MySQL Server or Cluster, leading to a complete denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no impact on confidentiality or integrity, but high impact on availability (CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The affected versions are explicitly stated as MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide direct confirmation of a patch or fix for these specific versions.

The vulnerability allows an attacker with low privileges and network access to cause a denial of service by hanging or crashing the MySQL Server or MySQL Cluster. This results in unavailability of the database service but does not compromise data confidentiality or integrity. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed and applied, consider restricting network access to MySQL Server and Cluster instances to trusted hosts only to reduce exposure.