CVE-2026-60314
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Vulnerability in MySQL Router (component: Router: General) versions 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable, no authentication required, attacker with network access via HTTP can cause hang or frequent crashes (DOS) of MySQL Router.
Risk Assessment
Risk of disruption of MySQL database routing, potentially leading to unavailability of applications relying on databases.
Recommendation
Update MySQL Router to version 8.4.11 or 9.7.2. Restrict network access to the router's HTTP interface.
Other vulnerabilities in MySQL Router
See all- CVE-2026-101810High
Vulnerability in MySQL Router (component: Router: General) of Oracle MySQL, affecting version 26.7.0. An easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to hang or repeatedly crash MySQL Router.
- CVE-2026-101783High
Vulnerability in MySQL Router (component: Router: General) affecting version 26.7.0. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to create, delete or modify critical data and gain full access to all router-accessible data.
- CVE-2026-101633Medium
Vulnerability in MySQL Router (component Router: General) version 26.7.0. It allows a low-privileged attacker with network access via HTTPS to gain unauthorized read access to a subset of MySQL Router accessible data.
- CVE-2026-101632Medium
Vulnerability in MySQL Router (component Router: General) version 26.7.0. It allows an unauthenticated attacker with network access via HTTPS to gain unauthorized read access to a subset of data, but requires human interaction.
- CVE-2026-101631Medium
Vulnerability in MySQL Router (component Router: General) version 26.7.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTPS to gain unauthorized creation, deletion, or modification access to critical data and full access to data, but requires human interaction.
- CVE-2026-60725High
Vulnerability in MySQL Router. Difficult to exploit, unauthenticated attacker via HTTP can compromise data confidentiality and integrity.
Original NVD description (English source)
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS