CVE-2026-35239: Oracle MySQL Server DoS Vulnerability

CVE-2026-35239 Overview

CVE-2026-35239 is a denial of service vulnerability affecting the MySQL Server product of Oracle MySQL, specifically within the Server: DML component. This vulnerability allows a high-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

The vulnerability is classified under CWE-284 (Improper Access Control), indicating weaknesses in how the DML component handles certain operations that can be exploited to disrupt service availability.

Critical Impact

Successful exploitation enables attackers to cause complete denial of service of MySQL Server instances, potentially disrupting critical database operations and dependent applications.

Affected Products

• Oracle MySQL Server 8.0.0 through 8.0.45
• Oracle MySQL Server 8.4.0 through 8.4.8
• Oracle MySQL Server 9.0.0 through 9.6.0

Discovery Timeline

• April 21, 2026 - CVE-2026-35239 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35239

Vulnerability Analysis

This vulnerability resides in the Data Manipulation Language (DML) component of MySQL Server. DML operations include critical database functions such as SELECT, INSERT, UPDATE, and DELETE statements. The flaw allows an authenticated attacker with elevated privileges to trigger conditions that result in server instability.

The attack is easily exploitable, requiring no user interaction, and can be executed remotely via multiple network protocols. While the vulnerability does not compromise data confidentiality or integrity, it poses a significant threat to service availability by enabling complete server crashes.

Root Cause

The vulnerability stems from improper access control handling within the DML processing layer of MySQL Server. Specifically, certain DML operations can be crafted to trigger resource exhaustion or processing errors that lead to an unrecoverable server state. This improper handling allows privileged users to manipulate the server into conditions where normal operation cannot be maintained.

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring physical access to the target system. An attacker must possess high-level privileges within the MySQL Server environment to exploit this vulnerability. The attack can be conducted through multiple protocols supported by MySQL Server, including the standard MySQL protocol.

The exploitation process involves sending specially crafted DML queries that trigger the vulnerable code path. When executed, these queries cause the server to enter a hung state or crash, requiring administrator intervention to restore service.

Technical exploitation details can be found in the Oracle Security Alert for April 2026.

Detection Methods for CVE-2026-35239

Indicators of Compromise

• Unexpected MySQL Server process terminations or crashes without apparent cause
• Repeated server hangs requiring forced restarts
• Unusual DML query patterns from privileged accounts in MySQL query logs
• Error log entries indicating server instability or resource exhaustion related to DML operations

Detection Strategies

• Monitor MySQL error logs for crash reports and abnormal termination patterns
• Implement query logging and analysis for anomalous DML statements from privileged users
• Deploy database activity monitoring (DAM) solutions to track privileged account behavior
• Configure alerting for repeated MySQL service restarts or failovers

Monitoring Recommendations

• Enable and review MySQL general query log for suspicious privileged account activity
• Configure performance schema monitoring for unusual resource consumption patterns
• Implement automated health checks to detect server hang conditions
• Set up alerting thresholds for MySQL availability metrics and restart frequencies

How to Mitigate CVE-2026-35239

Immediate Actions Required

• Apply the security patch provided in Oracle's April 2026 Critical Patch Update
• Review and restrict high-privilege account access to only essential personnel
• Implement network segmentation to limit MySQL Server exposure
• Enable enhanced monitoring on all privileged MySQL accounts

Patch Information

Oracle has released patches addressing this vulnerability as part of the April 2026 Critical Patch Update. Organizations running affected versions should upgrade to patched releases immediately. Detailed patch information and download links are available in the Oracle Security Alert for April 2026.

Affected version ranges requiring patching:

• MySQL Server 8.0.x: Upgrade to version 8.0.46 or later
• MySQL Server 8.4.x: Upgrade to version 8.4.9 or later
• MySQL Server 9.x: Upgrade to version 9.6.1 or later

Workarounds

• Restrict network access to MySQL Server using firewall rules to limit exposure to trusted hosts only
• Review and minimize the number of accounts with high privileges (such as SUPER or SYSTEM_USER)
• Implement connection rate limiting to slow potential exploitation attempts
• Consider deploying MySQL in a high-availability configuration to minimize downtime impact from potential crashes

# Example: Restrict MySQL network access using iptables
# Allow MySQL connections only from trusted application servers
iptables -A INPUT -p tcp --dport 3306 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Review privileged accounts in MySQL
mysql -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y' OR Create_user_priv='Y';"