Threats affecting pkg:maven/com.oracle/mysql-server

CVE-2026-60174 is a vulnerability in Oracle MySQL Server and MySQL Cluster affecting versions 9.7.0 through 9.7.1. It allows a low privileged attacker with network access via multiple protocols to cause a denial of service by hanging or crashing the server. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 6.5, indicating a medium severity. Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory but has not explicitly stated patch availability for these versions yet.

CVE-2026-35239 is a vulnerability in Oracle MySQL Server affecting versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.

CVE-2026-35237 is a vulnerability in Oracle MySQL Server affecting versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.

CVE-2026-35234 is a vulnerability in Oracle MySQL Server versions 9.0.0 through 9.6.0 affecting the Server: Partition component. It allows a high privileged attacker with network access via multiple protocols to cause a denial of service by hanging or repeatedly crashing the MySQL Server. The vulnerability has a CVSS 3.1 base score of 4.9, indicating a medium severity with impact limited to availability. Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory, which addresses numerous security issues across Oracle products.

CVE-2026-34272 is a vulnerability in Oracle MySQL Server versions 9.0.0 through 9.6.0 affecting the Server Optimizer component. It allows a low privileged attacker with network access via multiple protocols to cause a denial of service by hanging or crashing the MySQL Server. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with impact on availability only. Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory, which provides patches addressing this and many other vulnerabilities.

CVE-2026-34270 is a vulnerability in Oracle MySQL Server's Group Replication Plugin affecting versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.

CVE-2026-34267 is a vulnerability in Oracle MySQL Server versions 8.0.0 through 8.0.45 affecting the Server Optimizer component. It allows a high privileged attacker with network access via multiple protocols to cause a hang or repeated crash of the MySQL Server, resulting in a denial of service (DoS). The vulnerability has a CVSS 3.1 base score of 4.9, indicating a medium severity focused on availability impact. Oracle has included this vulnerability in its April 2026 Critical Patch Update, which provides security patches addressing this and other vulnerabilities.

CVE-2026-22005 is a vulnerability in Oracle MySQL Server affecting versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.

CVE-2026-22002 is a medium severity vulnerability in Oracle MySQL Server affecting versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.

CVE-2026-22001 is a low-severity vulnerability in Oracle MySQL Server affecting versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.

CVE-2026-21968 is a medium severity vulnerability in Oracle MySQL Server affecting versions 8.0.0 to 8.0.44, 8.4.0 to 8.4.7, and 9.0.

CVE-2026-21965 is a low-severity vulnerability in Oracle MySQL Server versions 9.0.0 through 9.5.0 affecting the Pluggable Authentication component. It allows a high-privileged attacker with network access via multiple protocols to cause a partial denial of service (DoS) on the MySQL Server. The vulnerability does not impact confidentiality or integrity but can degrade availability. Exploitation requires high privileges and no user interaction. There are no known exploits in the wild currently. The CVSS 3.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVE-2026-21937 is a medium severity vulnerability in Oracle MySQL Server versions 8.0.0 through 8.0.44, 8.4.0 through 8.4.7, and 9.0.

CVE-2026-21929 is a medium severity vulnerability in Oracle MySQL Server versions 9.0.0 through 9.5.0 affecting the server parser component. It allows a low privileged attacker with network access via multiple protocols to cause a denial of service by hanging or repeatedly crashing the MySQL Server. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation is difficult due to the high attack complexity and requires no user interaction but does require low privileges and network access. No known exploits are currently in the wild. European organizations relying on MySQL Server for critical database services could face service disruptions if targeted.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).