CVE-2026-101756
Description
A flaw was found in the Geographic Information System (GIS) component of MySQL. An authenticated remote attacker with high privileges can exploit this vulnerability over the network to cause a Denial of Service (DoS). Successful exploitation causes the database server to hang or crash repeatedly, disrupting service availability.
Statement
This vulnerability is rated as Moderate because exploitation requires high administrative privileges, preventing unauthenticated attackers or standard users from triggering the issue. Although an attacker with elevated credentials can induce a hang or crash of the database daemon, the impact is confined to availability without compromising confidentiality or integrity. Furthermore, supported database packages in Red Hat Enterprise Linux do not include the vulnerable code and are not affected.
Mitigation
Restrict network exposure of the MySQL daemon to authorized management endpoints using firewall rules:
firewall-cmd --permanent --zone=public --remove-service=mysql
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>
firewall-cmd --reload
Additionally, enforce the principle of least privilege by restricting administrative database roles and permissions to verified personnel only.
Caveats: Limiting network reachability blocks all inbound client connections that do not originate from the specified trusted address ranges.
Warning: Reloading firewall settings may terminate existing connections or disrupt active database sessions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.9 | N/A | 4.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
