CVE-2026-35238: Oracle MySQL Server DoS Vulnerability

CVE-2026-35238 Overview

CVE-2026-35238 is a Denial of Service vulnerability affecting the InnoDB component of Oracle MySQL Server. This vulnerability allows a highly privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server. The vulnerability is easily exploitable via multiple network protocols and poses a significant availability risk to database operations.

Critical Impact

Successful exploitation enables an authenticated attacker with high privileges to completely disrupt MySQL Server availability through a hang or repeatable crash condition.

Affected Products

• Oracle MySQL Server 8.0.0 through 8.0.45
• Oracle MySQL Server 8.4.0 through 8.4.8
• Oracle MySQL Server 9.0.0 through 9.6.0

Discovery Timeline

• April 21, 2026 - CVE-2026-35238 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35238

Vulnerability Analysis

This vulnerability resides within the InnoDB storage engine component of Oracle MySQL Server. InnoDB is the default storage engine for MySQL, responsible for handling transactions, crash recovery, and data integrity. The vulnerability is classified under CWE-284 (Improper Access Control), indicating a flaw in how the component manages access control decisions.

The attack requires high privileges, meaning an attacker must have administrative or elevated database credentials to exploit this vulnerability. However, once those conditions are met, the vulnerability is easily exploitable without any user interaction required. The impact is limited to availability—there is no confidentiality or integrity breach—but the ability to cause a complete denial of service can have severe operational consequences for database-dependent applications.

Root Cause

The vulnerability stems from improper access control (CWE-284) within the InnoDB component. The specific implementation flaw allows certain operations to trigger resource handling issues that lead to server instability. When exploited, the InnoDB engine fails to properly manage internal state or resources, causing the MySQL Server process to either hang indefinitely or crash in a repeatable manner.

Attack Vector

The attack is network-based and can be executed via multiple protocols supported by MySQL Server. An attacker with high-level database privileges (such as a compromised administrator account) can send specially crafted requests that trigger the vulnerable code path in InnoDB. The attack does not require user interaction and has low complexity once the attacker has obtained the necessary credentials.

The attack flow involves:

1. Establishing an authenticated network connection to the MySQL Server
2. Executing operations that interact with the InnoDB storage engine
3. Triggering the vulnerable condition that causes resource mismanagement
4. Resulting in server hang or crash, disrupting all database operations

Detection Methods for CVE-2026-35238

Indicators of Compromise

• Unexpected MySQL Server crashes or hang conditions without corresponding resource exhaustion
• Repeated server restarts within short time periods
• Anomalous database queries or operations from privileged accounts
• InnoDB-specific error messages in MySQL error logs preceding crash events

Detection Strategies

• Monitor MySQL error logs for InnoDB-related crash signatures and unexpected termination patterns
• Implement database activity monitoring to track operations from highly privileged accounts
• Configure alerting on MySQL Server process termination and automatic restart events
• Analyze authentication logs for suspicious access patterns to privileged database accounts

Monitoring Recommendations

• Enable MySQL general query log temporarily during investigation to capture queries preceding crashes
• Configure process monitoring for the mysqld process to detect unexpected terminations
• Set up database availability checks with appropriate alerting thresholds
• Review and audit high-privilege account usage and access patterns regularly

How to Mitigate CVE-2026-35238

Immediate Actions Required

• Upgrade MySQL Server to a patched version as specified in Oracle's security advisory
• Review and restrict high-privilege database account access to only essential personnel
• Implement network segmentation to limit network access to MySQL Server
• Enable audit logging to track privileged operations for forensic analysis

Patch Information

Oracle has released security patches addressing this vulnerability as part of the April 2026 Critical Patch Update. Administrators should upgrade to the latest patched versions of MySQL Server for their respective version branches. Detailed patch information and download links are available in the Oracle Security Alert April 2026.

Workarounds

• Restrict network access to MySQL Server using firewall rules to allow only trusted IP addresses
• Implement strict least-privilege principles for database accounts, minimizing the number of high-privilege users
• Deploy database activity monitoring solutions to detect and alert on suspicious privileged operations
• Consider implementing connection rate limiting and query timeout controls as additional defensive measures

# Example: Restrict MySQL network access with firewall rules
# Allow MySQL connections only from trusted application servers
iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Review and audit high-privilege accounts
mysql -u root -p -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y';"