UBUNTU-CVE-2026-101733: Medium severity ubuntu/mysql-5.5 vulnerability

Q: Can an unauthenticated remote attacker exploit this issue?

No. The CVSS vector specifies low privileges are required, so an attacker needs an existing low-privileged account as well as network access to the affected server or cluster.

Q: Is the expected impact limited to availability?

Based on the supplied CVSS impacts, confidentiality and integrity are not affected. Successful exploitation can cause a server or cluster hang or a repeatable crash, resulting in denial of service.

Q: Does exploitation require user interaction or difficult attack conditions?

No. The vulnerability is rated as requiring no user interaction and low attack complexity, with network access possible through multiple protocols.

Published Oct 20, 2026

Updated

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Affected Software

17 affected componentsFixes available

ubuntu/mysql-5.5*

ubuntu/mysql-5.7*

ubuntu/mariadb-10.0*

ubuntu/percona-server-5.6*

ubuntu/percona-xtradb-cluster-5.6*

ubuntu/mysql-5.7*

ubuntu/mariadb-10.1*

ubuntu/mysql-8.0*

ubuntu/mariadb-10.3*

ubuntu/mariadb-10.6*

ubuntu/mysql-8.0<8.0.46-0ubuntu0.22.04.5

8.0.46-0ubuntu0.22.04.5

ubuntu/mariadb*

ubuntu/mysql-8.0<8.0.46-0ubuntu0.24.04.5

8.0.46-0ubuntu0.24.04.5

ubuntu/mariadb*

ubuntu/mysql-9.7<9.7.4-0ubuntu0.26.10.1

9.7.4-0ubuntu0.26.10.1

ubuntu/mariadb*

ubuntu/mysql-8.4<8.4.13-0ubuntu0.26.04.2

8.4.13-0ubuntu0.26.04.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/mysql-8.0 to a version that resolves this vulnerability.
Fixed in 8.0.46-0ubuntu0.22.04.5
Upgrade
Upgrade ubuntu/mysql-8.0 to a version that resolves this vulnerability.
Fixed in 8.0.46-0ubuntu0.24.04.5
Upgrade
Upgrade ubuntu/mysql-9.7 to a version that resolves this vulnerability.
Fixed in 9.7.4-0ubuntu0.26.10.1
Upgrade
Upgrade ubuntu/mysql-8.4 to a version that resolves this vulnerability.
Fixed in 8.4.13-0ubuntu0.26.04.2

Event History

Oct 20, 2026

CVE Published

via OSV·10:18 PM

Data Sourced

via OSV·10:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Can an unauthenticated remote attacker exploit this issue?

No. The CVSS vector specifies low privileges are required, so an attacker needs an existing low-privileged account as well as network access to the affected server or cluster.

Is the expected impact limited to availability?

Based on the supplied CVSS impacts, confidentiality and integrity are not affected. Successful exploitation can cause a server or cluster hang or a repeatable crash, resulting in denial of service.

Does exploitation require user interaction or difficult attack conditions?

No. The vulnerability is rated as requiring no user interaction and low attack complexity, with network access possible through multiple protocols.

UBUNTU-CVE-2026-101733: Medium severity ubuntu/mysql-5.5 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Can an unauthenticated remote attacker exploit this issue?

Is the expected impact limited to availability?

Does exploitation require user interaction or difficult attack conditions?

Company

Resources

Contact