CVE-2026-101748: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mysql-9.7to a version that resolves this vulnerability.Fixed in 9.7.4-2
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Deployments of MySQL Server or MySQL Cluster running one of the listed affected versions are exposed if a low-privileged account can reach the service over the network through one of the affected protocols. The issue affects the Server: Security: Audit component.
What does an attacker need to exploit it?
An attacker needs network access and low privileges on the affected MySQL Server or MySQL Cluster instance. No user interaction is required, and the vulnerability is rated low complexity to exploit.
What is the likely impact of successful exploitation?
Successful exploitation can allow an attacker to hang the affected service or cause frequent repeatable crashes, resulting in a complete denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.
How can I determine whether an instance is affected?
Check whether the product is MySQL Server or MySQL Cluster and compare its version to the affected ranges: MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, or 26.7.0 through 26.7.1; and MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, or 26.7.0 through 26.7.1.