Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-20T21:22:50 mysql: MySQL: Denial of Service via the Group Replication plugin 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CWE-400

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

A flaw was found in the MySQL Group Replication plugin. An unauthenticated attacker located on the adjacent network can exploit this vulnerability to compromise the database service. Successful exploitation primarily allows an attacker to cause a Denial of Service (DoS) by hanging or repeatedly crashing the server, as well as perform unauthorized modifications to accessible data.

In Red Hat Enterprise Linux environments, this flaw is rated Important because an attacker on the adjacent network can trigger an unauthenticated denial of service or modify stored database contents. Exposure is naturally constrained because the MySQL Group Replication plugin is not enabled by default and requires deliberate clustering configuration. Consequently, only systems actively utilizing Group Replication within adjacent network segments are subject to exploitation. Red Hat Enterprise Linux 10 Affected mysql8.4 Red Hat Enterprise Linux 6 Not affected mysql Red Hat Enterprise Linux 9 Affected mysql Red Hat Hardened Images Not affected mariadb10.11 Red Hat Hardened Images Not affected mariadb11.8 https://www.cve.org/CVERecord?id=CVE-2026-101773 https://nvd.nist.gov/vuln/detail/CVE-2026-101773 https://www.oracle.com/security-alerts/cpuoct2026.html