CVE-2026-21968: MySQL Server Optimizer DoS Vulnerability

CVE-2026-21968 Overview

CVE-2026-21968 is a Denial of Service (DoS) vulnerability affecting the MySQL Server product of Oracle MySQL, specifically within the Server: Optimizer component. This vulnerability enables an authenticated attacker with low privileges and network access to cause a complete denial of service by triggering a hang or frequently repeatable crash of the MySQL Server.

Critical Impact

A low-privileged attacker can exploit this vulnerability remotely via multiple protocols to cause complete denial of service, resulting in MySQL Server becoming unavailable to legitimate users and applications.

Affected Products

• MySQL Server 8.0.0 through 8.0.44
• MySQL Server 8.4.0 through 8.4.7
• MySQL Server 9.0.0 through 9.5.0

Discovery Timeline

• January 20, 2026 - CVE-2026-21968 published to NVD
• January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21968

Vulnerability Analysis

This vulnerability resides in the MySQL Server Optimizer component, which is responsible for determining the most efficient execution plan for SQL queries. The flaw allows authenticated users with minimal privileges to craft specific queries that trigger resource exhaustion or an unhandled condition within the optimizer logic, leading to server instability.

The vulnerability is easily exploitable as it requires no user interaction and can be triggered via multiple network protocols supported by MySQL. While the attack does not compromise data confidentiality or integrity, the availability impact is severe—the server can be forced into a hang state or crash repeatedly, disrupting all database operations for connected applications.

Root Cause

The root cause lies within the query optimization logic of MySQL Server. When processing certain malformed or specially crafted SQL statements, the optimizer fails to properly handle edge cases, leading to either an infinite loop condition causing server hangs or an unhandled exception resulting in server crashes. This represents a classic resource exhaustion or algorithmic complexity vulnerability within the database engine's query processing pipeline.

Attack Vector

The attack is network-based and can be executed by any authenticated user with basic database privileges. The attacker connects to the MySQL Server using standard MySQL protocols and submits crafted SQL queries designed to trigger the vulnerable code path in the optimizer. No specialized tools are required—the attack can be performed using standard MySQL client utilities.

The exploitation mechanism involves:

1. Establishing an authenticated connection to the target MySQL Server
2. Submitting SQL queries that exercise the vulnerable optimizer code path
3. The optimizer enters a hang state or crashes during query planning
4. The MySQL Server becomes unavailable to all users

Since the vulnerability allows for "frequently repeatable crash" behavior, an attacker can continuously disrupt service even after the server is restarted, making this particularly impactful for high-availability database deployments.

Detection Methods for CVE-2026-21968

Indicators of Compromise

• Unusual patterns of MySQL Server crashes or restarts in system logs
• Repeated crash events originating from the optimizer component in MySQL error logs
• Database connections from suspicious sources followed immediately by server unavailability
• Abnormal query patterns targeting the optimizer with complex or malformed statements

Detection Strategies

• Monitor MySQL error logs for optimizer-related crash signatures and stack traces
• Implement query analysis rules to detect unusual or malicious SQL patterns
• Deploy network monitoring to identify repeated connection attempts correlating with server crashes
• Use SentinelOne Singularity Platform to monitor for abnormal MySQL process behavior and crash events

Monitoring Recommendations

• Configure MySQL audit logging to capture all queries from low-privileged users
• Set up alerting for MySQL Server process crashes or unexpected restarts
• Monitor system resource utilization for signs of resource exhaustion attacks
• Implement database activity monitoring (DAM) solutions to baseline normal query behavior

How to Mitigate CVE-2026-21968

Immediate Actions Required

• Upgrade MySQL Server to the latest patched version as soon as Oracle releases a security update
• Review and restrict database user privileges to the minimum required
• Implement network segmentation to limit MySQL Server exposure
• Enable connection rate limiting to slow down potential attack attempts

Patch Information

Oracle has addressed this vulnerability in their January 2026 Critical Patch Update. Administrators should apply the security patches immediately by upgrading to a fixed version of MySQL Server. Refer to the Oracle January 2026 Security Alert for detailed patch information and download links.

Workarounds

• Restrict network access to MySQL Server to trusted IP addresses only using firewall rules
• Review and audit all database users, removing unnecessary accounts and reducing privileges
• Consider implementing a database proxy or application firewall that can filter malicious queries
• Monitor for unusual query patterns and implement query timeout limits to mitigate impact

# Example: Restrict MySQL access at the firewall level
# Only allow connections from trusted application servers
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Set query timeout to limit impact of hanging queries
# Add to my.cnf under [mysqld] section
# max_execution_time=30000