Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

A flaw was found in MySQL within the Server Optimizer component. An authenticated remote attacker with high privileges can exploit this vulnerability over the network to cause the database to hang or crash repeatedly. Successful exploitation results in a complete Denial of Service (DoS) for the affected service.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because successful exploitation requires an authenticated attacker with high-level database privileges. While a privileged user with network connectivity can trigger a denial of service by causing the database server to hang or terminate unexpectedly via the query optimizer, the flaw does not compromise data confidentiality or integrity. In standard enterprise deployments, administrative accounts are tightly controlled and restricted to trusted personnel, significantly reducing the likelihood of malicious exploitation. Red Hat Enterprise Linux 10 Affected mysql8.4 Red Hat Enterprise Linux 6 Not affected mysql Red Hat Enterprise Linux 9 Affected mysql Red Hat Hardened Images Not affected mariadb10.11 Red Hat Hardened Images Not affected mariadb11.8 https://www.cve.org/CVERecord?id=CVE-2026-101787 https://nvd.nist.gov/vuln/detail/CVE-2026-101787 https://www.oracle.com/security-alerts/cpuoct2026.html