CVE-2026-35235: Oracle MySQL Server DoS Vulnerability

CVE-2026-35235 Overview

CVE-2026-35235 is a Denial of Service vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: GIS (Geographic Information System) component. This vulnerability allows a high-privileged attacker with network access via multiple protocols to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

Critical Impact

Successful exploitation enables attackers to completely disrupt MySQL Server availability, potentially causing significant service outages for applications dependent on database connectivity.

Affected Products

• Oracle MySQL Server versions 9.0.0 through 9.6.0

Discovery Timeline

• April 21, 2026 - CVE-2026-35235 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35235

Vulnerability Analysis

This vulnerability resides in the GIS (Geographic Information System) component of MySQL Server, which handles spatial data operations including geographic coordinates, polygons, and other geometric data types. The flaw is classified under CWE-284 (Improper Access Control), indicating that the vulnerability stems from inadequate restrictions on resource access or operations within the GIS subsystem.

The vulnerability is considered easily exploitable, meaning minimal technical expertise is required once an attacker has obtained the necessary high-privilege access. While the requirement for high privileges limits the attack surface, organizations with compromised administrative accounts or insider threats face significant risk of service disruption.

Root Cause

The root cause is tied to improper access control within the GIS component's handling of certain operations. When specific conditions are triggered by a privileged user, the server enters a state that causes either a hang condition or a repeatable crash. This suggests potential issues with resource management, input validation for GIS-specific functions, or improper error handling within the spatial data processing routines.

Attack Vector

The attack vector is network-based, allowing exploitation via multiple protocols supported by MySQL Server. An attacker requires high-privilege access (such as database administrator credentials) to execute the attack. The vulnerability requires no user interaction and has an unchanged scope, meaning the impact is confined to the MySQL Server component itself.

The attack can be executed remotely over the network, making it particularly dangerous in environments where administrative credentials may have been compromised or where insider threats exist. Since no user interaction is required, automated exploitation is possible once initial access is obtained.

Detection Methods for CVE-2026-35235

Indicators of Compromise

• Unexpected MySQL Server crashes or service restarts, particularly during GIS-related operations
• Abnormal administrative activity patterns from privileged database accounts
• Repeated connection attempts or queries targeting spatial/GIS functions from unusual sources
• MySQL error logs showing crashes related to GIS component operations

Detection Strategies

• Monitor MySQL error logs and crash dumps for patterns indicating GIS component failures
• Implement database activity monitoring to detect anomalous privileged user behavior
• Set up alerting for repeated server crashes or hang conditions
• Review authentication logs for suspicious administrative login patterns

Monitoring Recommendations

• Configure MySQL Server to log all administrative operations for audit purposes
• Implement network-level monitoring for unusual traffic patterns to MySQL ports
• Deploy SentinelOne agents to monitor for process anomalies and unexpected service terminations
• Establish baseline metrics for server availability and alert on deviations

How to Mitigate CVE-2026-35235

Immediate Actions Required

• Review and audit all accounts with high-privilege access to MySQL Server
• Implement strict network segmentation to limit administrative access to trusted networks only
• Apply the principle of least privilege to database accounts, removing unnecessary administrative rights
• Enable comprehensive logging and monitoring for all privileged database operations

Patch Information

Oracle has released a security patch addressing this vulnerability as part of the April 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for April 2026 for detailed patch information and upgrade to a patched version of MySQL Server.

Organizations running MySQL Server versions 9.0.0 through 9.6.0 should prioritize applying the security update. The patch should be tested in a non-production environment before deployment to production systems.

Workarounds

• Restrict network access to MySQL Server administrative interfaces using firewall rules
• Implement additional authentication controls for privileged database accounts
• Limit the use of GIS functionality to essential operations until patching is complete
• Consider temporarily disabling non-critical GIS features if operationally feasible

# Example: Restrict MySQL administrative access to specific IP ranges
# Add to MySQL configuration or use iptables/firewall rules

# Limit connections to MySQL port from trusted management network only
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP