Vulnerability-Lookup

RHSA-2026:56973

Vulnerability from csaf_opensuse - Published: 2026-08-19 16:23 - Updated: 2026-08-19 20:54

Summary

Red Hat Security Advisory: mysql:8.4 security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for the mysql:8.4 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: Performance Schema unspecified vulnerability (CPU Jul 2026) (CVE-2026-61081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47064) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-47012) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60331) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60190) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60177) * mysql: Optimizer unspecified vulnerability (CPU Jul 2026) (CVE-2026-60145) * mysql: DDL unspecified vulnerability (CPU Jul 2026) (CVE-2026-46936) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60186) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60315) * mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026) (CVE-2026-61096) * mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60163) * mysql: InnoDB unspecified vulnerability (CPU Jul 2026) (CVE-2026-47052) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60188) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60184) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60185) * mysql: JSON unspecified vulnerability (CPU Jul 2026) (CVE-2026-61109) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60191) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-61094) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60178) * mysql: Group Replication GCS unspecified vulnerability (CPU Jul 2026) (CVE-2026-60332) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60189) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60747) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-47023) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60183) * mysql: X Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60316) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60187) * mysql: Replication unspecified vulnerability (CPU Jul 2026) (CVE-2026-60585) * mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026) (CVE-2026-60182) Bug Fix(es) and Enhancement(s): * [tracker] Rebase MySQL to 8.4.11 (JIRA:RHEL-188045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-46936

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-413 - Improper Resource Locking

Affected products

Fixed 93 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-0:0.996-3.module+el9.8.0+24348+9b27f387.4.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-0:0.996-3.module+el9.8.0+24348+9b27f387.4.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-0:0.996-3.module+el9.8.0+24348+9b27f387.4.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-0:0.996-3.module+el9.8.0+24348+9b27f387.4.src::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-0:0.996-3.module+el9.8.0+24348+9b27f387.4.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-3.module+el9.8.0+24348+9b27f387.4.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-3.module+el9.8.0+24348+9b27f387.4.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-3.module+el9.8.0+24348+9b27f387.4.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debuginfo-0:0.996-3.module+el9.8.0+24348+9b27f387.4.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-3.module+el9.8.0+24348+9b27f387.4.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-3.module+el9.8.0+24348+9b27f387.4.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-3.module+el9.8.0+24348+9b27f387.4.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-debugsource-0:0.996-3.module+el9.8.0+24348+9b27f387.4.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-devel-0:0.996-3.module+el9.8.0+24348+9b27f387.4.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-devel-0:0.996-3.module+el9.8.0+24348+9b27f387.4.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-devel-0:0.996-3.module+el9.8.0+24348+9b27f387.4.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-devel-0:0.996-3.module+el9.8.0+24348+9b27f387.4.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.src::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mecab-ipadic-EUCJP-0:2.7.0.20070801-24.module+el9.8.0+24348+9b27f387.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-0:8.4.11-1.module+el9.8.0+24663+27effc5a.src::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-common-0:8.4.11-1.module+el9.8.0+24663+27effc5a.noarch::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debugsource-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debugsource-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debugsource-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-debugsource-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-devel-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-errmsg-0:8.4.11-1.module+el9.8.0+24663+27effc5a.noarch::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-libs-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-server-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-data-0:8.4.11-1.module+el9.8.0+24663+27effc5a.noarch::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:mysql-test-debuginfo-0:8.4.11-1.module+el9.8.0+24663+27effc5a.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-0:4.053-3.module+el9.8.0+24348+9b27f387.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-0:4.053-3.module+el9.8.0+24348+9b27f387.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-0:4.053-3.module+el9.8.0+24348+9b27f387.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-0:4.053-3.module+el9.8.0+24348+9b27f387.src::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-0:4.053-3.module+el9.8.0+24348+9b27f387.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debuginfo-0:4.053-3.module+el9.8.0+24348+9b27f387.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debuginfo-0:4.053-3.module+el9.8.0+24348+9b27f387.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debuginfo-0:4.053-3.module+el9.8.0+24348+9b27f387.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debuginfo-0:4.053-3.module+el9.8.0+24348+9b27f387.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debugsource-0:4.053-3.module+el9.8.0+24348+9b27f387.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debugsource-0:4.053-3.module+el9.8.0+24348+9b27f387.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debugsource-0:4.053-3.module+el9.8.0+24348+9b27f387.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:perl-DBD-MySQL-debugsource-0:4.053-3.module+el9.8.0+24348+9b27f387.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rapidjson-0:1.1.0-19.module+el9.8.0+24348+9b27f387.src::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rapidjson-devel-0:1.1.0-19.module+el9.8.0+24348+9b27f387.aarch64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rapidjson-devel-0:1.1.0-19.module+el9.8.0+24348+9b27f387.ppc64le::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rapidjson-devel-0:1.1.0-19.module+el9.8.0+24348+9b27f387.s390x::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rapidjson-devel-0:1.1.0-19.module+el9.8.0+24348+9b27f387.x86_64::mysql:8.4	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rapidjson-doc-0:1.1.0-19.module+el9.8.0+24348+9b27f387.noarch::mysql:8.4	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-47012

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-47023

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-47052

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-47064

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60145

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60163

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.

8.4 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Important

CVE-2026-60177

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60178

6.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-648 - Incorrect Use of Privileged APIs

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60182

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60183

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60184

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60185

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60186

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60187

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60188

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60189

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60190

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster.

2.2 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Low

CVE-2026-60191

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60315

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE-248 - Uncaught Exception

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Important

CVE-2026-60316

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-648 - Incorrect Use of Privileged APIs

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Important

CVE-2026-60331

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60332

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60585

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.

6.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-60747

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

CVE-2026-61081

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data.

2.7 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Low

CVE-2026-61094

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Important

CVE-2026-61096

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data.

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Low

CVE-2026-61109

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 93 products, the same list as for CVE-2026-46936

Threats

Impact Moderate

References

151 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:56973	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504779	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504823	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504848	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504855	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504877	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504925	external
https://bugzilla.redhat.com/show_bug.cgi?id=2504940	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505001	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505002	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505027	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505182	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505200	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505215	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505259	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505262	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505300	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505310	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505319	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505509	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505594	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505643	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505699	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505711	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505722	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505844	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505868	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505891	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505923	external
https://bugzilla.redhat.com/show_bug.cgi?id=2505927	external
https://issues.redhat.com/browse/RHEL-188045	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-46936	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505001	external
https://www.cve.org/CVERecord?id=CVE-2026-46936	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46936	external
https://www.oracle.com/security-alerts/cpujul2026.html	external
https://www.oracle.com/security-alerts/cpujul2026…	external
https://access.redhat.com/security/cve/CVE-2026-47012	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504848	external
https://www.cve.org/CVERecord?id=CVE-2026-47012	external
https://nvd.nist.gov/vuln/detail/CVE-2026-47012	external
https://access.redhat.com/security/cve/CVE-2026-47023	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505722	external
https://www.cve.org/CVERecord?id=CVE-2026-47023	external
https://nvd.nist.gov/vuln/detail/CVE-2026-47023	external
https://access.redhat.com/security/cve/CVE-2026-47052	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505215	external
https://www.cve.org/CVERecord?id=CVE-2026-47052	external
https://nvd.nist.gov/vuln/detail/CVE-2026-47052	external
https://access.redhat.com/security/cve/CVE-2026-47064	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504823	external
https://www.cve.org/CVERecord?id=CVE-2026-47064	external
https://nvd.nist.gov/vuln/detail/CVE-2026-47064	external
https://access.redhat.com/security/cve/CVE-2026-60145	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504940	external
https://www.cve.org/CVERecord?id=CVE-2026-60145	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60145	external
https://access.redhat.com/security/cve/CVE-2026-60163	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505200	external
https://www.cve.org/CVERecord?id=CVE-2026-60163	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60163	external
https://access.redhat.com/security/cve/CVE-2026-60177	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504925	external
https://www.cve.org/CVERecord?id=CVE-2026-60177	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60177	external
https://access.redhat.com/security/cve/CVE-2026-60178	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505594	external
https://www.cve.org/CVERecord?id=CVE-2026-60178	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60178	external
https://access.redhat.com/security/cve/CVE-2026-60182	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505927	external
https://www.cve.org/CVERecord?id=CVE-2026-60182	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60182	external
https://access.redhat.com/security/cve/CVE-2026-60183	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505844	external
https://www.cve.org/CVERecord?id=CVE-2026-60183	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60183	external
https://access.redhat.com/security/cve/CVE-2026-60184	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505262	external
https://www.cve.org/CVERecord?id=CVE-2026-60184	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60184	external
https://access.redhat.com/security/cve/CVE-2026-60185	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505300	external
https://www.cve.org/CVERecord?id=CVE-2026-60185	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60185	external
https://access.redhat.com/security/cve/CVE-2026-60186	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505002	external
https://www.cve.org/CVERecord?id=CVE-2026-60186	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60186	external
https://access.redhat.com/security/cve/CVE-2026-60187	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505891	external
https://www.cve.org/CVERecord?id=CVE-2026-60187	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60187	external
https://access.redhat.com/security/cve/CVE-2026-60188	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505259	external
https://www.cve.org/CVERecord?id=CVE-2026-60188	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60188	external
https://access.redhat.com/security/cve/CVE-2026-60189	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505699	external
https://www.cve.org/CVERecord?id=CVE-2026-60189	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60189	external
https://access.redhat.com/security/cve/CVE-2026-60190	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504877	external
https://www.cve.org/CVERecord?id=CVE-2026-60190	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60190	external
https://access.redhat.com/security/cve/CVE-2026-60191	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505319	external
https://www.cve.org/CVERecord?id=CVE-2026-60191	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60191	external
https://access.redhat.com/security/cve/CVE-2026-60315	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505027	external
https://www.cve.org/CVERecord?id=CVE-2026-60315	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60315	external
https://access.redhat.com/security/cve/CVE-2026-60316	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505868	external
https://www.cve.org/CVERecord?id=CVE-2026-60316	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60316	external
https://access.redhat.com/security/cve/CVE-2026-60331	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504855	external
https://www.cve.org/CVERecord?id=CVE-2026-60331	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60331	external
https://access.redhat.com/security/cve/CVE-2026-60332	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505643	external
https://www.cve.org/CVERecord?id=CVE-2026-60332	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60332	external
https://access.redhat.com/security/cve/CVE-2026-60585	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505923	external
https://www.cve.org/CVERecord?id=CVE-2026-60585	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60585	external
https://access.redhat.com/security/cve/CVE-2026-60747	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505711	external
https://www.cve.org/CVERecord?id=CVE-2026-60747	external
https://nvd.nist.gov/vuln/detail/CVE-2026-60747	external
https://access.redhat.com/security/cve/CVE-2026-61081	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504779	external
https://www.cve.org/CVERecord?id=CVE-2026-61081	external
https://nvd.nist.gov/vuln/detail/CVE-2026-61081	external
https://access.redhat.com/security/cve/CVE-2026-61094	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505509	external
https://www.cve.org/CVERecord?id=CVE-2026-61094	external
https://nvd.nist.gov/vuln/detail/CVE-2026-61094	external
https://access.redhat.com/security/cve/CVE-2026-61096	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505182	external
https://www.cve.org/CVERecord?id=CVE-2026-61096	external
https://nvd.nist.gov/vuln/detail/CVE-2026-61096	external
https://access.redhat.com/security/cve/CVE-2026-61109	self
https://bugzilla.redhat.com/show_bug.cgi?id=2505310	external
https://www.cve.org/CVERecord?id=CVE-2026-61109	external
https://nvd.nist.gov/vuln/detail/CVE-2026-61109	external

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2026-46936 (GCVE-0-2026-46936)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:32 – Updated: 2026-07-23 15:18

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 19:21 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-284 - Improper Access Control

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46936",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T19:21:53.834241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:18:43.077Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:32:48.555Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-46936",
    "datePublished": "2026-07-21T21:32:48.555Z",
    "dateReserved": "2026-05-18T15:55:10.312Z",
    "dateUpdated": "2026-07-23T15:18:43.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47012 (GCVE-0-2026-47012)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 15:08

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 15:07 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:07:05.506414Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:08:09.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:02.596Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47012",
    "datePublished": "2026-07-21T21:33:02.596Z",
    "dateReserved": "2026-05-18T15:55:10.317Z",
    "dateUpdated": "2026-07-23T15:08:09.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47023 (GCVE-0-2026-47023)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 15:27

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 15:26 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47023",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:26:42.822764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:27:02.974Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:06.123Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47023",
    "datePublished": "2026-07-21T21:33:06.123Z",
    "dateReserved": "2026-05-18T15:55:10.317Z",
    "dateUpdated": "2026-07-23T15:27:02.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47052 (GCVE-0-2026-47052)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 15:28

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 15:27 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:27:47.484603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:28:10.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:16.179Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47052",
    "datePublished": "2026-07-21T21:33:16.179Z",
    "dateReserved": "2026-05-18T15:55:10.319Z",
    "dateUpdated": "2026-07-23T15:28:10.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47064 (GCVE-0-2026-47064)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 17:05

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 16:13 UTC

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-284 - Improper Access Control

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47064",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T16:13:39.197024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T17:05:56.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:20.524Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-47064",
    "datePublished": "2026-07-21T21:33:20.524Z",
    "dateReserved": "2026-05-18T15:55:10.319Z",
    "dateUpdated": "2026-07-23T17:05:56.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60145 (GCVE-0-2026-60145)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 17:05

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 16:13 UTC

CWE

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-284 - Improper Access Control

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T16:13:42.876323Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T17:05:32.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:21.654Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-60145",
    "datePublished": "2026-07-21T21:33:21.654Z",
    "dateReserved": "2026-07-08T15:51:40.514Z",
    "dateUpdated": "2026-07-23T17:05:32.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60163 (GCVE-0-2026-60163)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-09-15 03:09

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 00:00 UTC

CWE

Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.
CWE-284 - Improper Access Control

Assigner

oracle mitre root Scorecard

References

2 references

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/15/1

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60163",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T03:56:08.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-15T03:09:31.057Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/15/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:27.340Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-60163",
    "datePublished": "2026-07-21T21:33:27.340Z",
    "dateReserved": "2026-07-08T15:51:40.516Z",
    "dateUpdated": "2026-09-15T03:09:31.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60177 (GCVE-0-2026-60177)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 16:13

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 16:13 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60177",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T16:13:17.100093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T16:13:38.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:32.200Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-60177",
    "datePublished": "2026-07-21T21:33:32.200Z",
    "dateReserved": "2026-07-08T15:51:40.518Z",
    "dateUpdated": "2026-07-23T16:13:38.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60178 (GCVE-0-2026-60178)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-28 03:56

Summary

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

Severity

6.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 00:00 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.
CWE-284 - Improper Access Control

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60178",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T03:56:09.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:32.550Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-60178",
    "datePublished": "2026-07-21T21:33:32.550Z",
    "dateReserved": "2026-07-08T15:51:40.518Z",
    "dateUpdated": "2026-07-28T03:56:09.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60182 (GCVE-0-2026-60182)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-09-17 18:38

Summary

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 15:03 UTC

CWE

Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.
CWE-400 - Uncontrolled Resource Consumption

Assigner

oracle mitre root Scorecard

References

1 reference

URL	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Oracle Corporation	MySQL Server	Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1
Oracle Corporation	MySQL Cluster	Affected: 8.0.0-8.0.47 Affected: 8.4.0-8.4.10 Affected: 9.7.0-9.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-60182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:03:47.009022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:38:42.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        },
        {
          "product": "MySQL Cluster",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0-8.0.47"
            },
            {
              "status": "affected",
              "version": "8.4.0-8.4.10"
            },
            {
              "status": "affected",
              "version": "9.7.0-9.7.1"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.47",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.7.1",
                  "versionStartIncluding": "9.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:34.274Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2026-60182",
    "datePublished": "2026-07-21T21:33:34.274Z",
    "dateReserved": "2026-07-08T15:51:40.519Z",
    "dateUpdated": "2026-09-17T18:38:42.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:56973

CVE-2026-46936 (GCVE-0-2026-46936)

CVE-2026-47012 (GCVE-0-2026-47012)

CVE-2026-47023 (GCVE-0-2026-47023)

CVE-2026-47052 (GCVE-0-2026-47052)

CVE-2026-47064 (GCVE-0-2026-47064)

CVE-2026-60145 (GCVE-0-2026-60145)

CVE-2026-60163 (GCVE-0-2026-60163)

CVE-2026-60177 (GCVE-0-2026-60177)

CVE-2026-60178 (GCVE-0-2026-60178)

CVE-2026-60182 (GCVE-0-2026-60182)

Tags

Sightings

Nomenclature

Related by attack behaviour