CVE-2026-21941: MySQL Server Optimizer DOS Vulnerability

CVE-2026-21941 Overview

CVE-2026-21941 is a Denial of Service vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Optimizer component. This vulnerability allows a high-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

Critical Impact

A successful exploitation allows attackers to completely disrupt MySQL Server availability, potentially causing significant business impact for organizations relying on affected database instances.

Affected Products

• MySQL Server 8.0.0 through 8.0.44
• MySQL Server 8.4.0 through 8.4.7
• MySQL Server 9.0.0 through 9.5.0

Discovery Timeline

• January 20, 2026 - CVE-2026-21941 published to NVD
• January 21, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21941

Vulnerability Analysis

This vulnerability resides in the Query Optimizer component of MySQL Server, which is responsible for determining the most efficient execution plan for SQL queries. The flaw is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the vulnerability allows an attacker to consume excessive server resources.

The vulnerability is easily exploitable and requires a high-privileged attacker with network access via multiple protocols. While the attack requires elevated privileges, the accessibility over the network increases the potential attack surface in environments where database administrative access is not properly segmented.

Root Cause

The root cause stems from improper resource management within the Optimizer component (CWE-400). When processing certain types of queries, the optimizer fails to properly limit resource consumption, allowing malicious input to trigger conditions that exhaust system resources or cause the server process to enter an unrecoverable state.

Attack Vector

The attack vector is network-based, requiring the attacker to have high-privilege access to the MySQL Server. The exploitation does not require user interaction and can be executed through multiple network protocols supported by MySQL. An attacker with administrative or elevated database privileges could craft specific queries or operations that trigger the vulnerability in the optimizer component, leading to a denial of service condition.

The vulnerability affects only availability - there is no impact on confidentiality or integrity of the data stored in the affected MySQL instances. However, the complete denial of service can have severe operational consequences for applications dependent on the database.

Detection Methods for CVE-2026-21941

Indicators of Compromise

• Unexpected MySQL Server crashes or hangs coinciding with administrative query execution
• Abnormal resource consumption patterns (CPU, memory) associated with the mysqld process
• Multiple connection timeouts or failures reported by application logs
• Error logs showing optimizer-related crashes or out-of-memory conditions

Detection Strategies

• Monitor MySQL Server error logs for crash dumps or segmentation faults related to the optimizer component
• Implement database activity monitoring to detect unusual query patterns from high-privileged accounts
• Configure alerting for sudden increases in database server resource utilization
• Review audit logs for suspicious administrative activities targeting query optimization features

Monitoring Recommendations

• Enable MySQL Server's performance schema to track query execution anomalies
• Implement network monitoring to detect unusual database traffic patterns from administrative accounts
• Configure health check endpoints to detect server unavailability conditions
• Set up automated restart policies with alerting to quickly recover from and identify exploitation attempts

How to Mitigate CVE-2026-21941

Immediate Actions Required

• Apply the security patch from Oracle's January 2026 Critical Patch Update immediately
• Review and restrict high-privilege database account access to only essential personnel
• Implement network segmentation to limit administrative database access to trusted networks
• Enable audit logging for all privileged database operations

Patch Information

Oracle has released a security patch addressing this vulnerability as part of the Oracle Critical Patch Update for January 2026. Organizations should upgrade to patched versions of MySQL Server:

• For MySQL 8.0.x: Upgrade to version 8.0.45 or later
• For MySQL 8.4.x: Upgrade to version 8.4.8 or later
• For MySQL 9.x: Upgrade to version 9.5.1 or later

Workarounds

• Restrict network access to MySQL Server administrative interfaces using firewall rules
• Implement strict privilege separation, ensuring only essential accounts have high-privilege access
• Consider deploying MySQL behind a proxy that can monitor and filter suspicious optimizer-related queries
• Enable MySQL's connection rate limiting to reduce the impact of repeated exploitation attempts

# Example: Restrict MySQL admin access to specific IP ranges
# Add to MySQL configuration (my.cnf)
[mysqld]
bind-address = 127.0.0.1
# Or use firewall rules to limit access
# iptables -A INPUT -p tcp --dport 3306 -s trusted_network/24 -j ACCEPT
# iptables -A INPUT -p tcp --dport 3306 -j DROP