CVE-2026-46863: High severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to MySQL Server and MySQL Cluster instances. Use firewall rules, ACLs or network security groups to allow connections only from trusted management/application IP addresses and block access from untrusted networks (including the public Internet). Place database instances behind internal networks or VPNs and do not expose MySQL ports to the Internet.
- Compensating control
Apply network segmentation and perimeter controls (WAF, reverse proxy, jump hosts) so that only authenticated and authorized application tiers can reach MySQL Server/Cluster; minimize the set of protocols and hosts allowed to connect.
- Operational
Implement service monitoring, alerting and automated recovery for MySQL Server and MySQL Cluster (process supervisors, automatic restart, failover). Monitor logs and availability metrics for hangs/crashes and ensure backups and redundancy are in place to reduce impact of outages.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46863?
CVE-2026-46863 has a high severity score of 7.5.
How do I fix CVE-2026-46863?
To fix CVE-2026-46863, upgrade to the latest version of the MySQL Server or MySQL Cluster that addresses this vulnerability.
Which versions are affected by CVE-2026-46863?
CVE-2026-46863 affects MySQL Server versions 8.4.0-8.4.9, 9.0.0-9.7.0 and MySQL Cluster versions 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0.
What component is vulnerable in CVE-2026-46863?
CVE-2026-46863 involves a vulnerability in the Server: Connection Handling component of Oracle MySQL.
What type of access does CVE-2026-46863 allow?
CVE-2026-46863 allows an unauthenticated user to exploit the vulnerability easily.