CVE-2026-34303: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to MySQL Server: block or limit access to MySQL listener ports and protocols to only trusted management hosts and networks using firewall rules, ACLs, or network segmentation. Remove or block exposure of MySQL from untrusted/public networks and disallow unnecessary protocols to reduce the ability of remote low-privileged attackers to reach the server.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34303?
CVE-2026-34303 has been classified as an easily exploitable vulnerability with a high level of severity.
What versions of MySQL Server are affected by CVE-2026-34303?
CVE-2026-34303 affects MySQL Server versions 8.0.0 to 8.0.45, 8.4.0 to 8.4.8, and 9.0.0 to 9.6.0.
How do I fix CVE-2026-34303?
To fix CVE-2026-34303, upgrade your MySQL Server to a version that is not affected by this vulnerability.
Can CVE-2026-34303 be exploited remotely?
Yes, CVE-2026-34303 can be exploited by low privileged attackers with network access via multiple protocols.
What component of MySQL Server does CVE-2026-34303 affect?
CVE-2026-34303 affects the optimizer component of the MySQL Server product.