CVE-2026-34270: Oracle MySQL Server DoS Vulnerability

CVE-2026-34270 Overview

CVE-2026-34270 is a denial of service vulnerability in the Oracle MySQL Server Group Replication Plugin. The flaw affects MySQL Server versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. A low-privileged attacker with network access can exploit the vulnerability through multiple protocols to compromise availability. Successful exploitation causes a hang or repeatable crash, resulting in complete denial of service of the MySQL Server instance. The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. Oracle published the fix in the April 2026 Critical Patch Update.

Critical Impact

Authenticated network attackers can trigger a complete denial of service against MySQL Server instances running the Group Replication Plugin, causing service hangs or repeatable crashes.

Affected Products

• Oracle MySQL Server versions 8.0.0 through 8.0.45
• Oracle MySQL Server versions 8.4.0 through 8.4.8
• Oracle MySQL Server versions 9.0.0 through 9.6.0

Discovery Timeline

• 2026-04-21 - CVE-2026-34270 published to NVD
• 2026-04-23 - Last updated in NVD database
• April 2026 - Oracle releases security patch in Critical Patch Update

Technical Details for CVE-2026-34270

Vulnerability Analysis

The vulnerability resides in the Group Replication Plugin of Oracle MySQL Server. The plugin enables synchronous multi-master replication across MySQL instances and processes replication protocol messages from authenticated database users. The flaw allows an attacker holding low-level privileges to trigger uncontrolled resource consumption within the plugin's message handling logic. Exploitation produces a server hang or a frequently repeatable crash, taking the database offline and disrupting downstream applications. The attack requires only network reachability to the MySQL Server through one of its supported protocols. No user interaction is required and the attack complexity is low.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] within the Group Replication Plugin. The plugin fails to properly bound or validate resource usage when handling certain replication-related operations. This allows a low-privileged user to force the server into a state where it exhausts internal resources or enters an unrecoverable execution path. Oracle has not published technical specifics of the affected code paths. The fix is delivered through the April 2026 Critical Patch Update.

Attack Vector

An attacker must hold low-privileged authenticated access to the MySQL Server. From this position the attacker issues crafted requests over the network using one of the protocols the server exposes. The Group Replication Plugin processes these requests and enters a hang state or crashes the entire server process. Confidentiality and integrity are not affected. Availability impact is high because the database becomes unresponsive until restarted, and the attack is repeatable, preventing successful recovery.

No public proof-of-concept exploit code is available. No verified code examples are published for CVE-2026-34270. Refer to the Oracle Security Alert April 2026 for vendor-supplied details.

Detection Methods for CVE-2026-34270

Indicators of Compromise

• Unexpected MySQL Server process crashes or hangs accompanied by Group Replication Plugin entries in the MySQL error log
• Repeated server restarts correlated with authenticated sessions from the same low-privileged account
• Loss of quorum or replication group state changes immediately following client activity

Detection Strategies

• Monitor MySQL error logs (error.log) for stack traces, signal handler output, and abnormal plugin shutdown messages referencing group_replication
• Alert on MySQL service availability metrics, including process uptime resets and failed health checks
• Correlate authentication audit events with crash events to identify the originating low-privileged account

Monitoring Recommendations

• Enable the MySQL Enterprise Audit plugin or equivalent to capture connection metadata and executed statements
• Track Group Replication performance schema tables such as replication_group_members for unexpected state transitions
• Forward MySQL logs and host telemetry to a centralized SIEM for correlation across the database fleet

How to Mitigate CVE-2026-34270

Immediate Actions Required

• Apply the Oracle April 2026 Critical Patch Update to all affected MySQL Server instances
• Inventory MySQL deployments to confirm version coverage across 8.0.x, 8.4.x, and 9.x branches
• Audit user accounts and revoke unnecessary privileges, particularly any granted access to Group Replication interfaces

Patch Information

Oracle addressed CVE-2026-34270 in the April 2026 Critical Patch Update. Administrators should upgrade to a fixed release published after MySQL Server 8.0.45, 8.4.8, or 9.6.0 as documented in the Oracle Security Alert April 2026. Restart the server after applying the binary update to load the patched Group Replication Plugin.

Workarounds

• Restrict network exposure of MySQL Server ports to trusted application hosts using firewall or security group rules
• Disable the Group Replication Plugin on instances that do not require multi-master replication
• Enforce least-privilege access and remove replication-related privileges from accounts that do not need them

# Restrict MySQL network exposure and review Group Replication state
sudo iptables -A INPUT -p tcp --dport 3306 ! -s <trusted_subnet> -j DROP

# Check whether the Group Replication plugin is loaded
mysql -uroot -p -e "SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME='group_replication';"

# Disable the plugin if multi-master replication is not required
mysql -uroot -p -e "UNINSTALL PLUGIN group_replication;"