CVE-2026-21949: MySQL Server DOS Vulnerability

CVE-2026-21949 Overview

CVE-2026-21949 is a Denial of Service vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Optimizer component. This vulnerability allows a low-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the MySQL Optimizer component fails to properly limit resource consumption during query processing. This can be exploited by authenticated users to exhaust server resources and disrupt database availability.

Critical Impact

Successful exploitation enables attackers to completely crash or hang MySQL Server instances, causing significant service disruption for applications dependent on the database.

Affected Products

• Oracle MySQL Server versions 9.0.0 through 9.5.0
• MySQL Server: Optimizer component
• All platforms running affected MySQL Server versions

Discovery Timeline

• 2026-01-20 - CVE-2026-21949 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-21949

Vulnerability Analysis

This vulnerability resides in the MySQL Server Optimizer component, which is responsible for query plan generation and optimization. The flaw allows authenticated users with low privileges to trigger resource exhaustion conditions through specially crafted queries.

The vulnerability is easily exploitable over the network via multiple protocols that MySQL supports, requiring only basic authentication credentials. The attack does not require user interaction, making it straightforward to execute once an attacker has network access and valid credentials.

The impact is limited to availability—there is no confidentiality or integrity breach. However, the ability to cause a complete denial of service can have severe operational consequences for organizations relying on MySQL for critical applications.

Root Cause

The root cause of CVE-2026-21949 is classified as CWE-400: Uncontrolled Resource Consumption. The MySQL Optimizer component does not properly constrain resource allocation when processing certain query patterns. This allows malicious queries to consume excessive CPU, memory, or other system resources, ultimately leading to service unavailability.

The Optimizer is a critical component that determines how queries are executed. When it fails to impose appropriate limits on processing complexity or resource usage, attackers can craft queries that exploit this oversight to trigger denial of service conditions.

Attack Vector

The attack vector is network-based, allowing exploitation from any system that can establish a connection to the MySQL Server. The attack characteristics include:

• Network Access Required: The attacker must have network connectivity to the MySQL Server
• Low Privileges: Only basic authenticated access is needed—no administrative privileges required
• Multiple Protocols: The vulnerability can be triggered via various MySQL-supported protocols
• No User Interaction: The attack can be executed automatically without requiring any actions from legitimate users
• Repeatable Impact: The denial of service condition can be triggered repeatedly, causing persistent availability issues

An attacker with valid database credentials can craft specific queries that target the vulnerable Optimizer behavior. When these queries are executed, the MySQL Server enters a hung state or crashes completely. Due to the low barrier to exploitation, any compromised or malicious user account poses a risk to database availability.

Detection Methods for CVE-2026-21949

Indicators of Compromise

• Sudden MySQL Server crashes or hangs without corresponding hardware or infrastructure issues
• Unusual query patterns targeting complex optimization scenarios
• Repeated connection attempts from specific user accounts followed by service degradation
• Error logs showing optimizer-related failures or resource exhaustion messages

Detection Strategies

• Monitor MySQL error logs for crash reports, optimizer errors, or out-of-memory conditions
• Implement query analysis to detect anomalous or overly complex queries targeting the optimizer
• Configure alerting for MySQL service availability to detect unexpected downtime
• Review authentication logs for suspicious activity from low-privileged accounts

Monitoring Recommendations

• Enable MySQL slow query logging and general query logging to capture potentially malicious queries
• Implement database activity monitoring (DAM) solutions to track query patterns
• Set up automated health checks for MySQL Server availability
• Monitor system resource utilization (CPU, memory) for unusual spikes correlated with specific queries

How to Mitigate CVE-2026-21949

Immediate Actions Required

• Review and apply the Oracle Critical Patch Update from January 2026 as soon as possible
• Audit MySQL user accounts and revoke unnecessary privileges
• Implement network segmentation to restrict MySQL Server access to trusted systems only
• Enable query timeout configurations to limit potential resource exhaustion

Patch Information

Oracle has addressed this vulnerability in the January 2026 Critical Patch Update. Administrators should apply the appropriate patches for MySQL Server versions 9.0.0 through 9.5.0 as detailed in the Oracle Security Alert January 2026.

Patching is the recommended remediation approach. Organizations should test patches in a staging environment before deploying to production MySQL instances.

Workarounds

• Restrict network access to MySQL Server using firewall rules to limit exposure
• Review and minimize user privileges, ensuring users have only necessary permissions
• Implement connection rate limiting to reduce the impact of repeated exploitation attempts
• Configure MySQL resource limits such as max_execution_time to abort long-running queries
• Consider deploying MySQL Enterprise Firewall to block suspicious query patterns

# Configuration example: Restrict resource usage and limit query execution time
# Add to my.cnf or my.ini configuration file

[mysqld]
# Set maximum execution time for SELECT statements (in milliseconds)
max_execution_time=30000

# Limit connections per user to reduce DoS impact
max_user_connections=50

# Enable slow query logging for detection
slow_query_log=1
slow_query_log_file=/var/log/mysql/slow.log
long_query_time=5