CVE-2026-21950: MySQL Server Optimizer DoS Vulnerability

CVE-2026-21950 Overview

CVE-2026-21950 is a Denial of Service vulnerability affecting the MySQL Server product of Oracle MySQL, specifically within the Server: Optimizer component. This vulnerability allows a low-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

The vulnerability exists in the query optimizer component, which is responsible for determining the most efficient execution plan for SQL queries. By crafting specific queries, an attacker can trigger resource exhaustion conditions that lead to service unavailability.

Critical Impact

Successful exploitation allows attackers to cause complete denial of service of MySQL Server, potentially disrupting critical database operations and dependent applications.

Affected Products

• Oracle MySQL Server versions 9.0.0 through 9.5.0
• MySQL Server Optimizer component
• Systems accessible via network protocols (MySQL, X Protocol)

Discovery Timeline

• January 20, 2026 - CVE-2026-21950 published to NVD
• January 21, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21950

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the MySQL Server Optimizer fails to properly limit resource consumption when processing certain types of queries. The flaw resides in the query optimization phase where malformed or specially crafted queries can consume excessive system resources.

The attack requires only low-level privileges, meaning any authenticated user with basic database access could potentially exploit this vulnerability. The attack is easily exploitable and does not require user interaction, making it particularly concerning for multi-tenant database environments or systems with less trusted users.

Root Cause

The root cause of this vulnerability lies in the MySQL Server's Optimizer component failing to implement proper resource bounds checking during query plan generation. When processing complex or maliciously crafted queries, the optimizer enters a state that leads to uncontrolled resource consumption, ultimately causing the server to hang or crash.

This type of vulnerability typically occurs when:

• Query complexity metrics are not properly validated
• Recursive optimization paths lack termination conditions
• Memory allocation during plan generation is unbounded

Attack Vector

The attack vector is network-based, allowing exploitation via multiple MySQL protocols. An attacker with low-level database privileges can execute specially crafted SQL queries that trigger the vulnerable code path in the optimizer. The attack does not require any user interaction and can be repeated reliably to maintain a denial of service condition.

The exploitation path typically involves:

1. Establishing a valid MySQL connection with low-privileged credentials
2. Submitting queries designed to stress the optimizer's resource handling
3. Causing the server to enter a hung state or crash repeatedly

Since no verified code examples are available for this vulnerability, organizations should consult the Oracle Security Alert January 2026 for detailed technical information and specific query patterns that trigger this issue.

Detection Methods for CVE-2026-21950

Indicators of Compromise

• Unexpected MySQL server crashes or service restarts with optimizer-related error messages in logs
• Abnormally high CPU or memory consumption by MySQL processes during query execution
• Error logs showing repeated query optimization failures or timeout conditions
• Unusual patterns of complex queries from specific database users or applications

Detection Strategies

• Monitor MySQL error logs for optimizer-related crashes, stack traces, or assertion failures
• Implement query execution monitoring to detect anomalous resource consumption patterns
• Enable MySQL Performance Schema to track query execution metrics and identify resource-intensive operations
• Configure alerting for MySQL service availability and automatic restart events

Monitoring Recommendations

• Set up real-time monitoring of MySQL server availability with rapid alerting on unexpected downtime
• Track query execution times and resource consumption, establishing baselines to detect anomalies
• Monitor system resources (CPU, memory) allocated to MySQL processes for unusual spikes
• Implement log aggregation to correlate crash events across MySQL server instances

How to Mitigate CVE-2026-21950

Immediate Actions Required

• Apply the security patch from Oracle's January 2026 Critical Patch Update immediately
• Review and restrict database privileges, ensuring users have only the minimum required permissions
• Implement query timeout limits using max_execution_time to prevent long-running queries from impacting server stability
• Consider implementing connection throttling and rate limiting for database access

Patch Information

Oracle has released security patches addressing this vulnerability as part of the January 2026 Critical Patch Update. Organizations running MySQL Server versions 9.0.0 through 9.5.0 should upgrade to the latest patched version immediately.

For detailed patch information and download links, refer to the Oracle Security Alert January 2026.

Workarounds

• Implement strict query timeout configurations using MySQL's max_execution_time system variable
• Restrict network access to MySQL servers using firewall rules, allowing only trusted hosts
• Review and minimize user privileges, removing unnecessary SELECT or query privileges where possible
• Deploy MySQL behind a database proxy that can implement additional query filtering and rate limiting

# Configuration example - MySQL timeout and resource limits
# Add to my.cnf or my.ini configuration file

[mysqld]
# Set maximum query execution time (milliseconds)
max_execution_time=30000

# Limit optimizer search depth for complex queries
optimizer_search_depth=10

# Set connection timeout to prevent hung connections
wait_timeout=300
interactive_timeout=300

# Limit maximum connections to prevent resource exhaustion
max_connections=150