CVE-2026-22017
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Affects versions 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. An easily exploitable flaw allows a low-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Risk Assessment
A low-privileged attacker can remotely crash the database server, causing unavailability of services relying on MySQL. Only availability is impacted, not confidentiality or integrity.
Recommendation
Update MySQL Server to a version containing the fix (outside the listed affected versions) and restrict network access to the database server to trusted sources.
Other vulnerabilities in MySQL Server
See all- CVE-2026-101637Medium
Vulnerability in MySQL Server and MySQL Cluster (component InnoDB) versions 9.7.0-9.7.3 and 26.7.0-26.7.1. It allows a high-privileged attacker with network access via multiple protocols to cause a hang or frequently repeatable crash (complete DoS) and unauthorized modification of some data.
- CVE-2026-101629Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster in the same versions. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS) of the server or cluster.
- CVE-2026-101627Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS), although exploitation is difficult.
- CVE-2026-101624Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101623Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101622Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101621Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101620Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 9.7.0-9.7.3 and MySQL Cluster 9.7.0-9.7.3. A low-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101619Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
- CVE-2026-101618Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
Original NVD description (English source)
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS