CVE-2026-35236: Oracle MySQL Server DoS Vulnerability

CVE-2026-35236 Overview

A vulnerability has been identified in the MySQL Server product of Oracle MySQL, specifically within the InnoDB storage engine component. This flaw allows a high-privileged attacker with network access to compromise the MySQL Server through multiple protocols. The vulnerability is classified as easily exploitable and can result in a complete denial of service (DoS) condition, causing the MySQL Server to hang or repeatedly crash.

Critical Impact
Successful exploitation enables attackers to cause complete service disruption of MySQL Server instances, resulting in database unavailability and potential business operations impact.

Affected Products

Oracle MySQL Server versions 8.0.0 through 8.0.45
Oracle MySQL Server versions 8.4.0 through 8.4.8
Oracle MySQL Server versions 9.0.0 through 9.6.0

Discovery Timeline

April 21, 2026 - CVE-2026-35236 published to NVD
April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35236

Vulnerability Analysis

This vulnerability resides in the InnoDB storage engine, which is the default and most commonly used storage engine in MySQL for transactional database operations. The flaw stems from improper access control (CWE-284) within the InnoDB component, allowing authenticated administrators to trigger conditions that destabilize the database server.

The attack requires network access and can be executed through multiple MySQL protocols. While the vulnerability requires high privileges to exploit, once executed, it can completely disrupt database availability. The scope is limited to the vulnerable component without impacting other system resources, and only availability is affected—confidentiality and integrity remain intact.

Root Cause

The root cause is classified under CWE-284 (Improper Access Control). The InnoDB storage engine fails to properly validate or restrict certain privileged operations, allowing authenticated high-privileged users to execute actions that lead to resource exhaustion or crash conditions within the database server.

Attack Vector

The attack leverages network connectivity to the MySQL Server through standard MySQL protocols. An attacker with administrative privileges can send specially crafted requests to the InnoDB component that trigger either a server hang or a repeatable crash condition. The attack requires no user interaction and can be automated once an attacker has obtained the necessary credentials.

The vulnerability is network-accessible with low attack complexity, though it does require high privileges (typically administrative access to the MySQL instance). This limits the attack surface to scenarios where administrative credentials have been compromised or where malicious insiders have elevated database access.

Detection Methods for CVE-2026-35236

Indicators of Compromise

Unexpected MySQL Server crashes or restarts, particularly those associated with InnoDB operations
Repeated server hangs occurring during database transactions without apparent cause
Unusual patterns of administrative queries targeting InnoDB-specific functionality
Error logs indicating InnoDB assertion failures or resource exhaustion conditions

Detection Strategies

Monitor MySQL error logs for InnoDB-related crash signatures and assertion failures
Implement database activity monitoring (DAM) to track administrative queries and privileged operations
Deploy anomaly detection for unusual patterns in MySQL connection behavior from administrative accounts
Configure alerts for MySQL service availability interruptions and automatic restart events

Monitoring Recommendations

Enable MySQL General Query Log or Audit Plugin to capture administrative operations for forensic analysis
Set up real-time monitoring of MySQL Server uptime and availability metrics
Configure automated alerting for service disruptions exceeding expected maintenance windows
Implement baseline monitoring for InnoDB performance metrics to detect degradation patterns

How to Mitigate CVE-2026-35236

Immediate Actions Required

Verify current MySQL Server version against affected version ranges (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0)
Review and restrict administrative access to MySQL Server instances to essential personnel only
Implement network segmentation to limit direct access to MySQL Server ports
Enable comprehensive logging to capture any exploitation attempts during the vulnerability window

Patch Information

Oracle has released security patches addressing this vulnerability as part of the April 2026 Critical Patch Update. Organizations should upgrade to patched versions of MySQL Server as specified in the Oracle Security Advisory.

For MySQL Server 8.0.x deployments, upgrade to version 8.0.46 or later. For MySQL Server 8.4.x deployments, upgrade to version 8.4.9 or later. For MySQL Server 9.x deployments, upgrade to version 9.6.1 or later as specified in Oracle's security bulletin.

Workarounds

Implement strict network access controls to limit MySQL Server connectivity to trusted IP ranges only
Enforce multi-factor authentication for all administrative database accounts
Apply principle of least privilege by reviewing and reducing unnecessary administrative account grants
Consider implementing connection rate limiting for administrative operations as an additional layer of protection

bash

# Example: Restrict MySQL administrative access to specific IP ranges
# Add to MySQL configuration (my.cnf or my.ini)
[mysqld]
bind-address = 127.0.0.1  # Bind to localhost only if external access not required

# For firewall-based restrictions (iptables example)
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP