CVE-2026-101722: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mysql-9.7to a version that resolves this vulnerability.Fixed in 9.7.4-2
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported versions are MySQL Server 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1, and MySQL Cluster 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1.
What access does an attacker need to exploit this issue?
An attacker needs network access to the affected service through multiple protocols and low-privileged access. No user interaction is required, and the attack complexity is low.
What is the likely impact of successful exploitation?
Successful exploitation can provide unauthorized read access to a subset of data accessible through the affected MySQL Server or MySQL Cluster deployment. The stated impact is limited to confidentiality; integrity and availability impacts are not identified.