CVE-2026-21964: MySQL Server Thread Pooling DoS Flaw

CVE-2026-21964 Overview

CVE-2026-21964 is a denial of service vulnerability affecting the MySQL Server product of Oracle MySQL, specifically within the Server: Thread Pooling component. This vulnerability allows a high-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

Critical Impact

Successful exploitation enables attackers to completely disrupt MySQL Server availability through denial of service attacks, potentially causing significant business disruption for organizations relying on affected database instances.

Affected Products

• MySQL Server 8.0.0 - 8.0.44
• MySQL Server 8.4.0 - 8.4.7
• MySQL Server 9.0.0 - 9.5.0

Discovery Timeline

• January 20, 2026 - CVE-2026-21964 published to NVD
• January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21964

Vulnerability Analysis

This vulnerability resides in the Thread Pooling component of MySQL Server, which manages concurrent database connections and query execution threads. The flaw enables an authenticated attacker with elevated privileges to trigger a condition that causes the server to hang or crash repeatedly.

The Thread Pooling mechanism in MySQL is designed to optimize performance by managing a pool of worker threads that handle client connections. When exploited, this vulnerability disrupts the normal operation of this pooling mechanism, leading to resource exhaustion or a crash state that prevents the server from processing legitimate requests.

The attack requires network access and can be executed via multiple protocols supported by MySQL Server. While the attacker must possess high privileges within the MySQL environment, the ease of exploitation makes this vulnerability a concern for database administrators managing multi-tenant or shared database infrastructure.

Root Cause

The vulnerability stems from improper handling within the Thread Pooling component when processing certain operations. This leads to a condition where the server's thread management becomes destabilized, resulting in either a hang state or a crash that can be repeatedly triggered by the attacker.

Attack Vector

The attack is conducted over the network using any of the multiple protocols supported by MySQL Server. An attacker who has obtained high-level administrative privileges on the MySQL instance can send specially crafted requests that exploit the Thread Pooling vulnerability.

The exploitation does not require user interaction, and the attacker can target the vulnerability directly from a network-accessible position. Once triggered, the denial of service condition affects the entire MySQL Server instance, impacting all connected clients and applications.

Detection Methods for CVE-2026-21964

Indicators of Compromise

• Unexpected MySQL Server crashes or hangs correlating with specific administrative operations
• Abnormal thread pool behavior or resource utilization patterns in MySQL process monitoring
• Repeated server restarts logged in MySQL error logs without apparent cause

Detection Strategies

• Monitor MySQL error logs for thread pooling-related errors and unexpected shutdown events
• Implement alerting for unusual connection patterns from high-privileged accounts
• Track MySQL Server uptime metrics and alert on unexpected restarts or availability gaps

Monitoring Recommendations

• Enable detailed logging for administrative operations within MySQL Server
• Configure database activity monitoring (DAM) solutions to track privileged user actions
• Implement network-level monitoring for unusual traffic patterns to MySQL Server ports

How to Mitigate CVE-2026-21964

Immediate Actions Required

• Upgrade MySQL Server to a patched version as soon as Oracle releases security updates
• Review and restrict high-privilege account access to only essential personnel
• Implement network segmentation to limit exposure of MySQL Server instances
• Enable enhanced monitoring for administrative activities on affected MySQL deployments

Patch Information

Oracle has addressed this vulnerability in the January 2026 Critical Patch Update. Administrators should consult the Oracle January 2026 Security Alert for detailed patching instructions and version-specific guidance.

Affected versions requiring updates:

• MySQL Server 8.0.x branch: Upgrade from versions 8.0.0 - 8.0.44 to the latest patched release
• MySQL Server 8.4.x branch: Upgrade from versions 8.4.0 - 8.4.7 to the latest patched release
• MySQL Server 9.x branch: Upgrade from versions 9.0.0 - 9.5.0 to the latest patched release

Workarounds

• Restrict network access to MySQL Server using firewall rules, limiting connections to trusted IP addresses only
• Implement the principle of least privilege by reviewing and reducing high-privilege account assignments
• Consider disabling thread pooling temporarily if feasible for your deployment (note: this may impact performance)
• Deploy MySQL Server behind a database firewall that can detect and block anomalous queries

# Example: Restrict MySQL access using iptables
# Allow MySQL connections only from trusted application servers
iptables -A INPUT -p tcp --dport 3306 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Review high-privilege accounts in MySQL
mysql -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y';"