Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

A flaw was found in the MySQL Server optimizer component. A remote attacker with high privileges can exploit this vulnerability over network protocols to cause the database server to hang or repeatedly crash. This issue results in a complete Denial of Service (DoS) of affected MySQL Server and MySQL Cluster instances.

This vulnerability is rated Moderate rather than Important because successful exploitation requires an attacker to possess high administrative privileges within the database instance. In standard enterprise deployments, access with elevated permissions is typically restricted to authorized database administrators, significantly limiting exposure to untrusted parties. While an authenticated user with sufficient rights could trigger query optimizer errors to crash or hang the database daemon, confidentiality and integrity of stored records remain unaffected. Red Hat Enterprise Linux 10 Affected mysql8.4 Red Hat Enterprise Linux 6 Not affected mysql Red Hat Enterprise Linux 9 Affected mysql Red Hat Hardened Images Not affected mariadb10.11 Red Hat Hardened Images Not affected mariadb11.8 https://www.cve.org/CVERecord?id=CVE-2026-101730 https://nvd.nist.gov/vuln/detail/CVE-2026-101730 https://www.oracle.com/security-alerts/cpuoct2026.html