CVE-2026-34278: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to MySQL Server to trusted IP addresses and networks using firewalls, network ACLs, or security groups. Block or limit any protocols and ports that are not required for operation and place MySQL instances on isolated/segmented networks (management VLANs) accessible only from trusted administration hosts or jump boxes.
- Operational
Review and reduce use of high-privilege MySQL accounts that can be reached over the network: disable or remove unnecessary privileged accounts, limit remote administration to trusted hosts, and require use of secure management channels. Implement monitoring for hangs/crashes and ensure operational recovery procedures (restart/HA/failover) are in place.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34278?
CVE-2026-34278 is considered to be an easily exploitable vulnerability that allows high privileged attackers to compromise MySQL Server.
How do I fix CVE-2026-34278?
To fix CVE-2026-34278, you should upgrade your MySQL Server installation to a version later than 8.0.45.
Who is affected by CVE-2026-34278?
CVE-2026-34278 affects supported versions of Oracle MySQL Server ranging from 8.0.0 to 8.0.45.
What components are involved in CVE-2026-34278?
CVE-2026-34278 involves a vulnerability in the MySQL Server component, specifically within the Optimizer.
What are the potential impacts of exploiting CVE-2026-34278?
Exploiting CVE-2026-34278 can allow attackers with network access to compromise the integrity and availability of the MySQL Server.