Threat Intelligence Database

CVE-2026-46862 is a high-severity vulnerability in Oracle MySQL Router versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0. It allows an unauthenticated attacker with network access via TLS to cause a denial of service by hanging or crashing MySQL Router. The vulnerability impacts availability but does not affect confidentiality or integrity. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, which contains patches for affected products including MySQL Router. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by blocking required network protocols or restricting privileges, although these mitigations may impact functionality.

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in takeover of MySQL Router. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).