CVE-2026-101789: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mysql-9.7to a version that resolves this vulnerability.Fixed in 9.7.4-2 - Upgrade
Upgrade
ubuntu/mysql-8.0to a version that resolves this vulnerability.Fixed in 8.0.46-0ubuntu0.22.04.5 - Upgrade
Upgrade
ubuntu/mysql-8.0to a version that resolves this vulnerability.Fixed in 8.0.46-0ubuntu0.24.04.5 - Upgrade
Upgrade
ubuntu/mysql-9.7to a version that resolves this vulnerability.Fixed in 9.7.4-0ubuntu0.26.10.1 - Upgrade
Upgrade
ubuntu/mysql-8.4to a version that resolves this vulnerability.Fixed in 8.4.13-0ubuntu0.26.04.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the MySQL Server or MySQL Cluster service and low-privileged credentials. No user interaction is required, and the issue is described as easily exploitable.
What is the impact of successful exploitation?
Successful exploitation can cause the affected MySQL Server or MySQL Cluster instance to hang or crash repeatedly, resulting in a complete denial of service. The stated impact is limited to availability; no confidentiality or integrity impact is listed.
Which deployments should be prioritized for review?
Prioritize reachable MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, along with MySQL Cluster versions 8.0.0 through 8.0.49 and the listed 8.4, 9.7, and 26.7 ranges. Systems where low-privileged database accounts can connect over the network are exposed to the described attack path.
What can be done while remediation is pending?
Restrict network access to the database service and limit low-privileged account access to only trusted users and systems. This reduces the set of attackers able to meet the required network-access and low-privilege conditions.