CVE-2026-21968: Oracle MySQL Server DOS Vulnerability

CVE-2026-21968 Overview

CVE-2026-21968 is a denial-of-service vulnerability in the Oracle MySQL Server product, specifically within the Server: Optimizer component. The flaw affects MySQL Server versions 8.0.0-8.0.44, 8.4.0-8.4.7, and 9.0.0-9.5.0. A low-privileged attacker with network access can exploit this vulnerability across multiple protocols without user interaction. Successful exploitation causes a hang or repeatable crash, resulting in complete denial of service of the MySQL Server. Oracle disclosed this issue in the January 2026 Critical Patch Update.

Critical Impact
Authenticated remote attackers can trigger a complete denial of service against affected MySQL Server instances, disrupting database availability for dependent applications.

Affected Products

Oracle MySQL Server 8.0.0 through 8.0.44
Oracle MySQL Server 8.4.0 through 8.4.7
Oracle MySQL Server 9.0.0 through 9.5.0

Discovery Timeline

2026-01-20 - CVE-2026-21968 published to NVD as part of Oracle's January 2026 Critical Patch Update
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-21968

Vulnerability Analysis

The vulnerability resides in the MySQL Server query optimizer, the subsystem responsible for parsing SQL statements and producing efficient execution plans. A crafted query reaches a code path in the optimizer that triggers a server hang or a repeatable crash. Because the optimizer is invoked for nearly every SQL statement, the attack surface is broad and reachable through any client protocol that submits queries.

The condition produces a complete denial of service. Availability is the only impacted property — confidentiality and integrity remain unaffected according to the published CVSS vector. Repeated exploitation prevents legitimate database operations until the server is restarted or patched.

Root Cause

Oracle has not published implementation-level technical details for this issue. The NVD entry classifies the weakness as NVD-CWE-noinfo. Based on the affected component and impact profile, the root cause is an unhandled condition in optimizer logic that, when exercised by a specific query pattern, leads to either an infinite loop or an unrecoverable fault. Refer to the Oracle Critical Patch Update Advisory - January 2026 for vendor guidance.

Attack Vector

Exploitation requires network reachability to the MySQL Server and a valid low-privileged account. No user interaction is required. The attacker submits a malicious query through any supported MySQL protocol — including the classic MySQL protocol, MySQL X Protocol, or any proxied connection. The query triggers the optimizer flaw, causing the mysqld process to hang or crash. With EPSS at 0.066% (percentile 20.384), in-the-wild exploitation prediction is currently low, and no public proof-of-concept is available.

Detection Methods for CVE-2026-21968

Indicators of Compromise

Unexpected mysqld process crashes or restarts logged in mysqld.log or systemd journal entries
Server hangs accompanied by stalled queries visible in SHOW PROCESSLIST and high optimizer CPU usage
Repeated connection failures or timeouts from application tiers following query submission by a specific account

Detection Strategies

Monitor MySQL error logs for assertion failures, signal handler entries, or InnoDB: Assertion messages correlated with low-privileged session activity
Audit performance_schema.events_statements_history for malformed or unusually complex queries preceding server crashes
Correlate authentication events from low-privileged accounts with subsequent service interruptions to identify probing behavior

Monitoring Recommendations

Enable the MySQL general query log or audit plugin to capture full query text from non-administrative accounts
Configure alerts on mysqld process restarts, health-check failures, and replication lag spikes that indicate primary instability
Track query execution time outliers and abrupt drops in Queries_per_second metrics through Prometheus, Datadog, or equivalent telemetry

How to Mitigate CVE-2026-21968

Immediate Actions Required

Apply the patches from the Oracle Critical Patch Update - January 2026 to all affected MySQL Server instances
Restrict network access to MySQL ports (3306, 33060) using firewall rules and security groups so only trusted application hosts can connect
Review and remove unused database accounts to reduce the population of low-privileged credentials available to attackers
Rotate credentials for any account that does not require interactive query access

Patch Information

Oracle released fixes for this vulnerability in the January 2026 Critical Patch Update. Upgrade to a MySQL Server release later than 8.0.44, 8.4.7, or 9.5.0 as indicated in the Oracle Security Alert January 2026. Apply patches during a scheduled maintenance window and validate replication topology after the upgrade.

Workarounds

Enforce least-privilege grants so accounts cannot execute arbitrary SELECT statements against sensitive schemas while patches are staged
Deploy a SQL-aware proxy such as ProxySQL or MySQL Router to filter or rate-limit anomalous query patterns
Enable connection rate limiting and max_user_connections per account to slow repeated exploitation attempts
Configure automated mysqld restart through systemd to reduce downtime if a crash occurs before patching is complete

bash

# Restrict MySQL listener to trusted application subnet and limit user connections
# /etc/mysql/mysql.conf.d/mysqld.cnf
bind-address = 10.0.10.25
max_user_connections = 50

# Firewall example: allow only application tier
iptables -A INPUT -p tcp --dport 3306 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP