CVE-2026-34308: Oracle MySQL Server DOS Vulnerability

CVE-2026-34308 Overview

CVE-2026-34308 is a denial of service vulnerability affecting the JSON component of Oracle MySQL Server. This easily exploitable flaw allows a low-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server instance.

Critical Impact

Successful exploitation enables attackers to completely disrupt MySQL Server availability, causing service outages that can significantly impact dependent applications and business operations.

Affected Products

• Oracle MySQL Server 8.0.0 through 8.0.45
• Oracle MySQL Server 8.4.0 through 8.4.8
• Oracle MySQL Server 9.0.0 through 9.6.0

Discovery Timeline

• 2026-04-21 - CVE-2026-34308 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-34308

Vulnerability Analysis

This vulnerability resides in the Server: JSON component of Oracle MySQL Server and is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw allows an authenticated attacker with minimal privileges to trigger resource exhaustion conditions within the JSON processing subsystem, leading to a complete denial of service.

The attack can be executed remotely over the network via multiple protocols supported by MySQL, making it accessible to any user who has basic authentication credentials to the database server. The vulnerability does not impact confidentiality or integrity of data but poses a significant availability risk to affected MySQL deployments.

Root Cause

The root cause is traced to improper resource management within the JSON parsing and processing logic of MySQL Server. When handling specially crafted JSON data or operations, the server fails to properly limit resource consumption, allowing an attacker to exhaust system resources and trigger a crash or hang condition. This represents a classic resource exhaustion vulnerability where input validation and resource bounds checking are insufficient.

Attack Vector

The attack is network-based and requires only low-level privileges to execute. An attacker with valid MySQL credentials can exploit this vulnerability by:

1. Establishing a network connection to the vulnerable MySQL Server
2. Authenticating with minimal user privileges
3. Submitting malicious JSON operations or data designed to trigger the resource exhaustion condition
4. Causing the server to enter a hung state or crash repeatedly

The vulnerability is considered easily exploitable due to the low privilege requirements and network accessibility. No user interaction is required for successful exploitation.

Detection Methods for CVE-2026-34308

Indicators of Compromise

• Unexpected MySQL Server crashes or service restarts without apparent cause
• High resource consumption (CPU or memory) associated with JSON processing operations
• Error logs showing JSON-related exceptions or resource exhaustion messages
• Repeated connection attempts from specific users executing JSON-heavy queries

Detection Strategies

• Monitor MySQL error logs for frequent crash reports or resource exhaustion warnings
• Implement query auditing to track JSON operations from authenticated users
• Deploy database activity monitoring (DAM) solutions to detect anomalous query patterns
• Configure alerting for MySQL service availability and unexpected restarts

Monitoring Recommendations

• Enable MySQL Performance Schema to track JSON operation resource usage
• Set up real-time monitoring for MySQL process stability and availability
• Implement rate limiting on JSON operations where operationally feasible
• Configure SentinelOne agents to monitor database server processes for anomalous behavior

How to Mitigate CVE-2026-34308

Immediate Actions Required

• Identify all Oracle MySQL Server instances running affected versions (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0)
• Apply the security patch from Oracle's April 2026 Critical Patch Update immediately
• Review and restrict user privileges, removing unnecessary JSON operation permissions
• Implement network segmentation to limit exposure of MySQL servers to trusted networks only

Patch Information

Oracle has released a security patch for this vulnerability as part of the Oracle Critical Patch Update April 2026. Administrators should apply this update to all affected MySQL Server instances as soon as possible. The patch addresses the resource consumption issue in the JSON component to prevent exploitation.

Workarounds

• Restrict network access to MySQL Server using firewall rules to limit exposure to trusted clients only
• Review and minimize user privileges, particularly for accounts that do not require JSON functionality
• Implement query timeouts and resource limits at the database level to contain potential impact
• Consider deploying a web application firewall (WAF) or database firewall to filter potentially malicious queries

# Example: Restrict MySQL access to specific networks via firewall
# iptables rule to allow MySQL connections only from trusted subnet
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# MySQL user privilege review - list users with JSON privileges
mysql -e "SELECT user, host FROM mysql.user WHERE Select_priv='Y';"