REDHAT-BUG-2505319: Medium severity Oracle MySQL Server vulnerability

Q: Who is realistically exposed to this issue?

Systems running the affected MySQL Server or MySQL Cluster versions are exposed only to an attacker who already has high privileges and local logon access to the infrastructure where the service executes. The issue is not described as remotely exploitable or requiring user interaction.

Q: What impact could successful exploitation have?

A successful attack can cause MySQL Server or MySQL Cluster to hang or crash repeatedly, resulting in a complete denial of service. No confidentiality or integrity impact is identified in the provided CVSS vector.

Q: Which versions are affected?

Affected MySQL Server versions are 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. Affected MySQL Cluster versions are 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.

Q: What should be prioritized if patching cannot happen immediately?

Restrict high-privilege local access to the infrastructure hosting MySQL Server or MySQL Cluster, since exploitation requires both local access and high privileges. Monitor affected services for unexplained hangs or recurring crashes, as these are the stated attack outcome.

Published Jul 21, 2026

Updated

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected Software

2 affected components

Oracle MySQL Server>=8.4.0<=8.4.10, >=9.7.0<=9.7.1

Oracle MySQL Cluster>=8.0.0<=8.0.47, >=8.4.0<=8.4.10, >=9.7.0<=9.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle MySQL (MySQL Server / MySQL Cluster) - Server: Replication to a version that resolves this vulnerability.
Fixed in 8.4.0-8.4.10
Upgrade
Upgrade Oracle MySQL (MySQL Server / MySQL Cluster) - Server: Replication to a version that resolves this vulnerability.
Fixed in 9.7.0-9.7.1
Upgrade
Upgrade Oracle MySQL (MySQL Server / MySQL Cluster) - Server: Replication to a version that resolves this vulnerability.
Fixed in 8.0.0-8.0.47

Event History

Jul 21, 2026

Data Sourced

via Red Hat·10:26 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems running the affected MySQL Server or MySQL Cluster versions are exposed only to an attacker who already has high privileges and local logon access to the infrastructure where the service executes. The issue is not described as remotely exploitable or requiring user interaction.

What impact could successful exploitation have?

A successful attack can cause MySQL Server or MySQL Cluster to hang or crash repeatedly, resulting in a complete denial of service. No confidentiality or integrity impact is identified in the provided CVSS vector.

Which versions are affected?

Affected MySQL Server versions are 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. Affected MySQL Cluster versions are 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.

What should be prioritized if patching cannot happen immediately?

Restrict high-privilege local access to the infrastructure hosting MySQL Server or MySQL Cluster, since exploitation requires both local access and high privileges. Monitor affected services for unexplained hangs or recurring crashes, as these are the stated attack outcome.

REDHAT-BUG-2505319: Medium severity Oracle MySQL Server vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What impact could successful exploitation have?

Which versions are affected?

What should be prioritized if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What impact could successful exploitation have?

Which versions are affected?

What should be prioritized if patching cannot happen immediately?