CVE-2026-22004: Oracle MySQL Server DoS Vulnerability

CVE-2026-22004 Overview

CVE-2026-22004 is a Denial of Service (DoS) vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the InnoDB storage engine component. This vulnerability allows a high-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

The vulnerability is classified as easily exploitable, meaning the attack complexity is low once an attacker has obtained the required high-level privileges. The impact is limited to availability, with no effect on confidentiality or integrity of the system.

Critical Impact

A successful exploit allows attackers to completely disrupt MySQL Server availability, potentially causing significant database downtime and service interruptions for dependent applications.

Affected Products

• Oracle MySQL Server versions 8.0.0 through 8.0.45
• Oracle MySQL Server versions 8.4.0 through 8.4.8
• Oracle MySQL Server versions 9.0.0 through 9.6.0

Discovery Timeline

• April 21, 2026 - CVE-2026-22004 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22004

Vulnerability Analysis

This vulnerability resides in the InnoDB component of Oracle MySQL Server, which is the default storage engine for MySQL. InnoDB provides ACID-compliant transaction features including commit, rollback, and crash-recovery capabilities to protect user data.

The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption), indicating that the flaw relates to improper handling of resource allocation or consumption within the InnoDB engine. When exploited, the vulnerability causes the MySQL Server to enter a hung state or experience frequent, repeatable crashes.

The attack requires network access and can be executed via multiple protocols supported by MySQL Server. While high privileges are required to exploit this vulnerability, authenticated database administrators or applications with elevated database permissions could potentially trigger this condition, either intentionally or through manipulation by an attacker who has compromised such credentials.

Root Cause

The root cause of CVE-2026-22004 is uncontrolled resource consumption (CWE-400) within the InnoDB storage engine. This class of vulnerability occurs when an application does not properly limit the resources it allocates or consumes, allowing an attacker to exhaust system resources and cause a denial of service.

In this case, specific operations performed by a high-privileged user can trigger resource exhaustion or an unhandled error condition within InnoDB, leading to server instability or complete service unavailability.

Attack Vector

The attack vector is network-based, requiring the attacker to have network connectivity to the MySQL Server instance. The exploitation requires:

1. High-level privileges on the MySQL Server (administrative or elevated database permissions)
2. Network access to the target MySQL Server via supported protocols (typically TCP port 3306)
3. Execution of specific database operations that trigger the vulnerability in the InnoDB component

The vulnerability does not require user interaction and the scope is unchanged, meaning the impact is limited to the vulnerable MySQL Server instance itself. An attacker with the necessary privileges could craft specific queries or operations targeting the InnoDB engine to cause the server to hang or crash repeatedly.

Detection Methods for CVE-2026-22004

Indicators of Compromise

• Unexpected MySQL Server crashes or hangs coinciding with high-privileged user sessions
• Repeated crash-recovery cycles in MySQL error logs
• Unusual InnoDB-related error messages or warnings in server logs
• Abnormal resource consumption patterns prior to service disruption

Detection Strategies

• Monitor MySQL error logs for InnoDB-related crash or hang conditions
• Implement database activity monitoring to track privileged user operations
• Set up alerting for MySQL service availability and unexpected restarts
• Review audit logs for suspicious database operations from high-privileged accounts

Monitoring Recommendations

• Enable MySQL audit logging to capture privileged operations
• Configure application-level health checks to detect MySQL Server unavailability
• Implement automated monitoring for MySQL process status and responsiveness
• Establish baseline metrics for InnoDB performance to identify anomalous behavior

How to Mitigate CVE-2026-22004

Immediate Actions Required

• Apply the Oracle Critical Patch Update for April 2026 immediately
• Review and restrict high-privilege database accounts to essential personnel only
• Implement network segmentation to limit MySQL Server exposure
• Enable comprehensive logging for database operations from privileged accounts

Patch Information

Oracle has released security patches addressing this vulnerability in the April 2026 Critical Patch Update. Affected organizations should upgrade to the following patched versions:

• MySQL Server 8.0.46 or later (for 8.0.x series)
• MySQL Server 8.4.9 or later (for 8.4.x series)
• MySQL Server 9.6.1 or later (for 9.x series)

The official security advisory is available from the Oracle Critical Patch Update Advisory.

Workarounds

• Limit network access to MySQL Server using firewall rules and access control lists
• Restrict high-privilege database accounts and implement role-based access controls
• Consider implementing database proxy solutions to add an additional layer of access control
• Isolate MySQL Server instances in segmented network zones with strict ingress controls

# Example: Restrict MySQL access to specific IP ranges using iptables
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Example: Review high-privileged MySQL accounts
mysql -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y' OR Create_user_priv='Y';"