CVE-2026-46862: MySQL Router DoS Vulnerability

CVE-2026-46862 Overview

CVE-2026-46862 is a denial-of-service vulnerability affecting Oracle MySQL Router. The flaw resides in the Router: General component and allows an unauthenticated remote attacker with network access via TLS to crash or hang the router process. Affected versions include MySQL Router 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0. Oracle addressed the issue in the June 2026 Critical Patch Update. The weakness is classified as Uncontrolled Resource Consumption [CWE-400], and exploitation requires no user interaction or privileges.

Critical Impact
Successful exploitation results in a complete denial of service of MySQL Router, breaking connectivity between application clients and backend MySQL servers.

Affected Products

Oracle MySQL Router 8.4.0 through 8.4.9
Oracle MySQL Router 9.0.0 through 9.7.0
Deployments using MySQL Router as a connection proxy for InnoDB Cluster or ReplicaSet topologies

Discovery Timeline

2026-06-17 - CVE-2026-46862 published to NVD
2026-06-17 - Oracle Security Alert June 2026 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46862

Vulnerability Analysis

MySQL Router is the lightweight middleware that routes client connections to MySQL InnoDB Cluster nodes. The vulnerability allows a network-resident attacker to send crafted traffic over the TLS-secured listener and trigger either a process hang or a repeatable crash. Because no authentication is required, any host able to reach the router's TLS port can carry out the attack. Confidentiality and integrity remain intact, but availability is fully impacted because the router cannot service legitimate connections during the condition.

Root Cause

The root cause aligns with [CWE-400] Uncontrolled Resource Consumption. The router's TLS-facing code path mishandles specific input conditions, leading to resource exhaustion or an unrecoverable state. Oracle has not published low-level technical details. Refer to the Oracle Security Alert June 2026 for vendor guidance.

Attack Vector

The attack vector is network-based and reachable over TLS. An attacker establishes a connection to the MySQL Router endpoint and submits malicious traffic that triggers the hang or crash. The exploit complexity is low, and no privileges or user interaction are required. In clustered deployments, repeated crashes can cascade into prolonged outages for dependent applications.

No public proof-of-concept code is available. Refer to the Oracle Security Alert June 2026 for vendor-provided remediation details.

Detection Methods for CVE-2026-46862

Indicators of Compromise

Unexpected mysqlrouter process termination or restart events in system logs
Sudden spikes in TLS connection attempts to MySQL Router listener ports followed by service unavailability
Application-side connection timeouts or Lost connection to MySQL server errors clustered in time

Detection Strategies

Monitor MySQL Router log files for abnormal crash signatures, abrupt shutdowns, or repeated restart sequences
Correlate TLS handshake anomalies on router ports (default 6446/6448) with downstream connection failures
Track process supervisor events (systemd, container restart counters) for the mysqlrouter service

Monitoring Recommendations

Alert on MySQL Router process restarts exceeding a defined threshold within a short interval
Ingest router and host telemetry into a centralized SIEM for time-correlated analysis across the cluster
Enable network flow monitoring to identify unusual source IPs initiating bursts of TLS connections to router ports

How to Mitigate CVE-2026-46862

Immediate Actions Required

Apply the Oracle Critical Patch Update from June 2026 to all MySQL Router instances running affected versions
Inventory all MySQL Router deployments and confirm versions against the affected ranges 8.4.0-8.4.9 and 9.0.0-9.7.0
Restrict network exposure of MySQL Router ports to trusted application subnets only

Patch Information

Oracle released fixes as part of the June 2026 Critical Patch Update. Administrators should upgrade MySQL Router beyond version 8.4.9 in the 8.4 branch and beyond 9.7.0 in the 9.x branch. Consult the Oracle Security Alert June 2026 for the exact fixed builds and download instructions.

Workarounds

Place MySQL Router behind a network access control list that permits only known application server IPs
Deploy rate limiting or connection throttling at the network layer to slow malicious connection bursts
Implement automated process supervision to restart the router quickly if a crash occurs, reducing outage duration until patching completes

bash

# Example iptables restriction limiting MySQL Router TLS exposure
iptables -A INPUT -p tcp --dport 6446 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6448 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6446 -j DROP
iptables -A INPUT -p tcp --dport 6448 -j DROP