CVE-2026-22017: Oracle MySQL Server DoS Vulnerability

CVE-2026-22017 Overview

CVE-2026-22017 is a Denial of Service vulnerability affecting the MySQL Server product of Oracle MySQL, specifically within the Server: Optimizer component. This vulnerability allows a low-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

The vulnerability is classified as easily exploitable, requiring only low privileges and network access via multiple protocols. While it does not impact confidentiality or integrity, it poses a significant availability risk to database operations, making it a critical concern for organizations relying on MySQL for production workloads.

Critical Impact

Successful exploitation enables attackers to cause complete denial of service to MySQL Server instances, potentially disrupting critical database operations and dependent applications.

Affected Products

• Oracle MySQL Server 8.0.0 through 8.0.45
• Oracle MySQL Server 8.4.0 through 8.4.8
• Oracle MySQL Server 9.0.0 through 9.6.0

Discovery Timeline

• April 21, 2026 - CVE-2026-22017 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22017

Vulnerability Analysis

This vulnerability resides in the MySQL Server Optimizer component, which is responsible for determining the most efficient execution plan for SQL queries. The flaw involves improper resource consumption (CWE-400: Uncontrolled Resource Consumption), where specially crafted queries can cause the optimizer to enter a state that leads to resource exhaustion or an infinite processing loop.

The attack can be executed by any authenticated user with network access to the MySQL Server, regardless of their privilege level. This low barrier to entry increases the risk profile, as even users with minimal database permissions could potentially exploit this vulnerability to disrupt service.

The vulnerability affects all recent major version branches of MySQL Server, spanning versions 8.0.x, 8.4.x, and 9.x, indicating the issue is present in core optimizer logic that has been carried across multiple releases.

Root Cause

The root cause is categorized as CWE-400 (Uncontrolled Resource Consumption). The MySQL Server Optimizer fails to properly limit resource consumption when processing certain query patterns. This allows an attacker to craft malicious queries that trigger excessive CPU consumption, memory allocation, or cause the optimizer to enter an infinite loop, ultimately leading to service unavailability.

Attack Vector

The vulnerability is exploitable over the network via multiple protocols supported by MySQL Server. An attacker requires:

1. Network Access: Ability to connect to the MySQL Server instance
2. Low Privileges: Basic authentication credentials (any valid database user)
3. No User Interaction: The attack can be executed autonomously

The attacker submits specially crafted SQL queries targeting the optimizer component. When the optimizer attempts to process these queries, it enters a problematic state that results in a hang or crash of the MySQL Server process.

Due to the nature of the vulnerability, no proof-of-concept code has been publicly disclosed. The exploitation involves crafting SQL queries that trigger edge cases in the optimizer's query planning logic. For technical details, refer to the Oracle Critical Patch Update April 2026.

Detection Methods for CVE-2026-22017

Indicators of Compromise

• Unexpected MySQL Server process hangs or crashes without clear cause
• Abnormal CPU utilization spikes correlated with query processing
• Repeated connection timeouts or query execution failures reported by applications
• Error logs showing optimizer-related crashes or resource exhaustion messages

Detection Strategies

• Monitor MySQL error logs for optimizer crash signatures and abnormal termination events
• Implement query performance monitoring to identify queries with unusually long optimization phases
• Configure alerting on MySQL Server availability and response time degradation
• Analyze slow query logs for suspicious query patterns targeting complex optimization scenarios

Monitoring Recommendations

• Deploy real-time monitoring for MySQL Server process health and resource utilization
• Establish baseline metrics for query optimization time to detect anomalous behavior
• Implement automated restart procedures with alerting for unexpected MySQL crashes
• Use network-level monitoring to detect unusual query volumes from specific authenticated users

How to Mitigate CVE-2026-22017

Immediate Actions Required

• Apply the Oracle Critical Patch Update April 2026 to all affected MySQL Server instances
• Review and restrict database user privileges to minimize the attack surface
• Monitor MySQL Server instances for signs of exploitation attempts
• Consider implementing query timeouts to limit impact of resource-intensive queries

Patch Information

Oracle has released patches addressing this vulnerability as part of the Critical Patch Update April 2026. Organizations should upgrade to the following patched versions:

• MySQL Server 8.0.46 or later for the 8.0.x branch
• MySQL Server 8.4.9 or later for the 8.4.x branch
• MySQL Server 9.6.1 or later for the 9.x branch

For complete patch details and download instructions, refer to the Oracle Critical Patch Update April 2026.

Workarounds

• Implement strict query timeouts using max_execution_time to prevent long-running queries from causing extended outages
• Restrict network access to MySQL Server instances using firewall rules to limit potential attackers
• Review and audit all database accounts, removing unnecessary user access
• Consider implementing a database proxy or firewall solution capable of query analysis and blocking

# Configuration example - Implement query execution timeout
# Add to MySQL configuration file (my.cnf or my.ini)
[mysqld]
max_execution_time=30000
# Sets maximum execution time to 30 seconds for SELECT statements

# Alternatively, set at session level for immediate effect
# mysql> SET GLOBAL max_execution_time=30000;