CVE-2026-47012: MySQL Server & Cluster DoS Vulnerability

CVE-2026-47012 Overview

CVE-2026-47012 is a denial of service vulnerability in the Oracle MySQL Server and MySQL Cluster Optimizer component. The flaw affects MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, along with MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Exploitation requires network access and high privileges, and Oracle characterizes the attack complexity as high. Successful exploitation causes a hang or repeatable crash resulting in complete denial of service. The weakness is tracked as uncontrolled resource consumption [CWE-400].

Critical Impact
A high-privileged authenticated attacker with network access can force a complete denial of service against MySQL Server or MySQL Cluster through the Optimizer component.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
Oracle MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-47012 published to NVD as part of the Oracle Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47012

Vulnerability Analysis

The vulnerability resides in the Server: Optimizer subcomponent shared by MySQL Server and MySQL Cluster. The Optimizer transforms SQL statements into execution plans by evaluating join orders, index usage, and cost estimates. A high-privileged attacker can submit crafted queries over multiple network protocols that trigger unbounded resource consumption during optimization. The result is either a server hang or a repeatable crash, producing complete availability loss. Oracle rates the confidentiality and integrity impact as none, meaning data disclosure and tampering are not in scope for this issue. The EPSS score sits at 0.336%, placing the vulnerability in the 25.98 percentile for exploitation likelihood.

Root Cause

The root cause maps to [CWE-400] Uncontrolled Resource Consumption within the query optimization path. The Optimizer fails to enforce upper bounds on resources consumed while planning specific query shapes. Attackers who can author and execute SQL against the server can drive the optimizer into a state that exhausts CPU or memory. Oracle did not publicly disclose the specific query construct or optimizer routine at fault.

Attack Vector

Exploitation requires network reachability to the database and valid credentials with elevated privileges. The attacker connects using one of the multiple supported MySQL protocols and issues the malformed or resource-intensive query. Because high privileges are required, the primary threat model is a malicious insider, a compromised administrative account, or a lateral-movement scenario where an adversary has already obtained database credentials. See the Oracle Critical Patch Update advisory for vendor detail.

No public proof-of-concept code has been released for this vulnerability. The vulnerability is described in prose because Oracle has not disclosed the offending query pattern or optimizer routine.

Detection Methods for CVE-2026-47012

Indicators of Compromise

Repeated MySQL Server or ndbd process crashes with restarts logged by the service manager or mysqld_safe
Sustained high CPU or memory consumption tied to specific optimizer threads or query IDs
Unexpected server hangs where client connections stall without returning results
Slow query log entries showing queries that time out during optimization rather than execution

Detection Strategies

Enable and review the MySQL general query log and slow query log to identify queries that consistently precede crashes or hangs
Correlate mysqld core dumps or crash logs with the connecting user, source IP, and executed statement
Monitor the MySQL error log for repeated assertion failures or optimizer-related stack traces
Alert on privileged database accounts issuing atypical query patterns from unexpected client hosts

Monitoring Recommendations

Track availability metrics such as Uptime, connection error rates, and process restart counts
Baseline optimizer runtime using performance schema statements tables including events_statements_summary_by_digest
Forward MySQL error logs and audit plugin output to a centralized logging platform for retention and correlation
Review authentication events for privileged accounts and flag credential use from new source addresses

How to Mitigate CVE-2026-47012

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster deployments
Inventory database servers to identify instances running the vulnerable versions listed above
Audit accounts holding administrative privileges and revoke unused privileged grants
Restrict network access to MySQL listener ports so only application hosts and administrators can connect

Patch Information

Oracle addressed CVE-2026-47012 in the Oracle Critical Patch Update advisory for July 2026. Upgrade MySQL Server to a version later than 8.4.10 or 9.7.1, and upgrade MySQL Cluster to a version later than 8.0.47, 8.4.10, or 9.7.1, per Oracle guidance.

Workarounds

Limit privileged account distribution and enforce multi-factor authentication for database administrators when supported
Place MySQL instances behind network segmentation so untrusted networks cannot reach database ports
Configure connection resource limits with max_user_connections, max_execution_time, and per-account resource quotas to constrain runaway sessions
Enable the MySQL Enterprise Audit plugin or an equivalent audit mechanism to record all privileged query activity

bash

# Example: constrain resources for a database user to limit DoS impact
ALTER USER 'app_admin'@'%' 
  WITH MAX_QUERIES_PER_HOUR 1000
       MAX_UPDATES_PER_HOUR 500
       MAX_CONNECTIONS_PER_HOUR 100
       MAX_USER_CONNECTIONS 10;

# Enforce a global statement execution timeout (milliseconds)
SET GLOBAL MAX_EXECUTION_TIME = 30000;