CVE-2026-22005: Oracle MySQL Server DoS Vulnerability

CVE-2026-22005 Overview

A denial of service vulnerability exists in the MySQL Server product of Oracle MySQL, specifically within the Server: Optimizer component. This vulnerability allows a highly privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

Critical Impact

Successful exploitation enables attackers to completely disrupt MySQL Server availability through resource exhaustion, causing service outages for dependent applications and databases.

Affected Products

• Oracle MySQL Server versions 8.0.0 through 8.0.45
• Oracle MySQL Server versions 8.4.0 through 8.4.8
• Oracle MySQL Server versions 9.0.0 through 9.6.0

Discovery Timeline

• 2026-04-21 - CVE-2026-22005 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-22005

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the MySQL Server Optimizer component fails to properly limit resource utilization during query processing. When an attacker crafts specific queries targeting the optimizer, the server can enter a state where it consumes excessive resources, leading to service unavailability.

The vulnerability is easily exploitable but requires high privileges (PR:H), meaning the attacker must already have significant database access rights. The attack can be conducted remotely over the network via multiple protocols supported by MySQL, including TCP/IP connections and named pipes.

The impact is limited to availability—there is no unauthorized access to or modification of data (Confidentiality and Integrity impacts are None). However, the availability impact is classified as High, indicating a complete loss of service availability when successfully exploited.

Root Cause

The root cause lies in the MySQL Server's query optimizer component, which handles query execution planning and optimization. The optimizer fails to properly validate or constrain certain input parameters during query processing, allowing resource exhaustion conditions to occur. This represents an uncontrolled resource consumption weakness where the system does not properly limit the amount of resources that can be consumed by an operation.

Attack Vector

The attack is network-based, allowing remote exploitation by authenticated users with high privileges. The attacker sends specially crafted SQL queries that trigger inefficient processing in the optimizer component. These queries cause the server to enter a resource-intensive state, resulting in either a hang condition or a crash that can be repeatedly triggered. The low attack complexity means no specialized conditions or preparations are required beyond having the necessary privileges and network access.

The vulnerability manifests when the optimizer processes certain query patterns that trigger resource exhaustion. Attackers with administrative or elevated database privileges can exploit this to deny service to legitimate users. For detailed technical information about exploitation patterns, refer to the Oracle Security Alert April 2026.

Detection Methods for CVE-2026-22005

Indicators of Compromise

• MySQL Server processes consuming abnormally high CPU or memory resources
• Frequent MySQL server crashes or restarts without clear cause
• Unusual query patterns in MySQL general or slow query logs from privileged users
• Connection timeouts or service unavailability reported by applications

Detection Strategies

• Monitor MySQL error logs for optimizer-related crashes or resource exhaustion messages
• Implement query analysis to detect unusual or malformed optimizer-targeting queries
• Deploy database activity monitoring to identify suspicious behavior from privileged accounts
• Configure MySQL performance schema to track resource-intensive query execution

Monitoring Recommendations

• Enable MySQL slow query log with low threshold to capture resource-intensive queries
• Set up alerting for MySQL server process crashes and unexpected restarts
• Monitor system-level metrics (CPU, memory) for MySQL processes
• Review privileged user activity logs for anomalous query patterns

How to Mitigate CVE-2026-22005

Immediate Actions Required

• Upgrade MySQL Server to a patched version as specified in Oracle's security advisory
• Review and restrict high-privileged database accounts to only essential users
• Implement network segmentation to limit access to MySQL Server from untrusted networks
• Enable query timeouts to prevent long-running optimizer operations

Patch Information

Oracle has released patches addressing this vulnerability in the April 2026 Critical Patch Update. Affected organizations should apply the appropriate patches for their MySQL Server version as soon as possible. Detailed patch information and download links are available from the Oracle Security Alert April 2026.

Workarounds

• Implement strict access controls to limit users with high privileges
• Configure firewall rules to restrict network access to MySQL Server
• Enable MySQL query execution time limits using max_execution_time system variable
• Deploy a database firewall or proxy to filter potentially malicious queries

# Configuration example - Limit query execution time
# Add to MySQL configuration file (my.cnf or my.ini)
[mysqld]
max_execution_time=30000  # 30 seconds maximum query time