CVE-2026-35234: Oracle MySQL Server DOS Vulnerability

CVE-2026-35234 Overview

CVE-2026-35234 is a Denial of Service vulnerability affecting the Server: Partition component in Oracle MySQL Server. This flaw allows a high privileged attacker with network access to cause MySQL Server to hang or repeatedly crash, resulting in a complete denial of service condition. The vulnerability is easily exploitable via multiple network protocols.

Critical Impact

Successful exploitation allows attackers with high privileges to completely disrupt MySQL Server availability through repeatable crashes or system hangs, potentially impacting critical database operations and dependent applications.

Affected Products

• Oracle MySQL Server versions 9.0.0 through 9.6.0

Discovery Timeline

• April 21, 2026 - CVE-2026-35234 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35234

Vulnerability Analysis

This vulnerability resides in the Server: Partition component of Oracle MySQL Server. The flaw is classified under CWE-284 (Improper Access Control), indicating that the vulnerability stems from inadequate access control mechanisms within the partition handling functionality.

The vulnerability requires network access and high privileges to exploit, meaning an attacker must already possess administrative-level database credentials. However, once these prerequisites are met, the exploitation path is straightforward with low attack complexity. The impact is confined to availability—there is no compromise of data confidentiality or integrity.

The partition component in MySQL handles table partitioning operations, which divide large tables into smaller, more manageable segments. Malformed partition operations or specific sequences of partition-related commands can trigger conditions that cause the server process to enter an unrecoverable state, leading to service disruption.

Root Cause

The root cause is attributed to improper access control (CWE-284) within the MySQL Server's partition handling logic. This allows authenticated administrators to trigger resource exhaustion or invalid state conditions that the server cannot gracefully recover from, resulting in a crash or hang condition.

Attack Vector

The attack is conducted over the network via standard MySQL protocols. An attacker with high privileges (such as database administrator credentials) can send specially crafted partition-related commands or sequences that exploit the vulnerability. The attack does not require user interaction and affects only the local MySQL Server instance (unchanged scope).

Since no verified code examples are available, the vulnerability mechanism involves sending partition manipulation commands through an authenticated MySQL connection. The specific command sequences or malformed requests that trigger the denial of service condition are detailed in Oracle's security advisory.

Detection Methods for CVE-2026-35234

Indicators of Compromise

• Unexpected MySQL Server crashes or restarts, particularly during partition-related operations
• Database error logs showing partition component failures or abnormal terminations
• Unusual administrative activity patterns from high-privileged database accounts
• Repeated connection attempts from administrative accounts followed by server instability

Detection Strategies

• Monitor MySQL error logs for crashes related to the partition component or unexpected server shutdowns
• Implement database activity monitoring to track administrative actions involving partition operations
• Configure alerting for multiple rapid MySQL service restarts or availability interruptions
• Deploy SentinelOne Singularity to detect anomalous process behavior and crash patterns in database services

Monitoring Recommendations

• Enable detailed MySQL general query logging for administrative accounts to audit partition commands
• Set up real-time alerting for MySQL service availability using health check mechanisms
• Monitor system resources for unusual memory or CPU consumption patterns during partition operations
• Review administrative account access patterns for deviation from baseline behavior

How to Mitigate CVE-2026-35234

Immediate Actions Required

• Review and restrict high-privilege database account access to only essential personnel
• Implement network segmentation to limit administrative access paths to MySQL Server
• Enable enhanced logging for partition-related database operations
• Apply the Oracle security patch as soon as possible after testing in a non-production environment

Patch Information

Oracle has released a security update addressing this vulnerability as part of the April 2026 Critical Patch Update. Administrators should apply the patch to all affected MySQL Server installations running versions 9.0.0 through 9.6.0. The official security advisory and patch details are available in the Oracle Security Alert April 2026.

Workarounds

• Restrict network access to MySQL Server administrative interfaces using firewall rules
• Implement the principle of least privilege by auditing and reducing high-privilege account usage
• Consider temporary disabling of partition operations if not business-critical until patching is complete
• Monitor and limit administrative sessions to prevent potential exploitation attempts

# Restrict MySQL administrative access to specific trusted hosts
# Add to MySQL configuration (my.cnf)
[mysqld]
bind-address = 127.0.0.1
# Or configure host-based access restrictions in MySQL
# GRANT ALL PRIVILEGES ON *.* TO 'admin'@'trusted_host_ip' IDENTIFIED BY 'password';