CVE-2026-47023: Oracle MySQL Server DoS Vulnerability

CVE-2026-47023 Overview

CVE-2026-47023 is a denial of service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. A high-privileged attacker with network access via multiple protocols can trigger a hang or repeatable crash of affected instances. The vulnerability is classified under CWE-400: Uncontrolled Resource Consumption and results in complete availability loss. Oracle disclosed the flaw in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in a complete denial of service against MySQL Server or MySQL Cluster instances, disrupting database-dependent applications and downstream replication topologies.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-47023 published to NVD via Oracle's July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47023

Vulnerability Analysis

The flaw resides in the Replication subsystem of MySQL Server and MySQL Cluster. Exploitation requires an authenticated attacker holding high privileges within the database environment. The attacker sends crafted requests through one of several supported network protocols to interact with the replication component. Processing these requests causes the server to hang or crash on a repeatable basis.

The issue maps to CWE-400: Uncontrolled Resource Consumption. The replication code path fails to bound resource usage when handling attacker-controlled input, producing a complete denial of service condition. Only availability is affected; confidentiality and integrity remain intact.

The EPSS probability is 0.31%, indicating low observed exploitation activity in the wild. However, the low attack complexity and network reachability make this a practical risk in environments where replication users or administrative accounts are compromised.

Root Cause

The root cause is unbounded resource handling within the MySQL replication component. Malformed or abusive input from a privileged session is not properly constrained, allowing the server process to enter an unrecoverable state. Oracle has not published the specific code path in the public advisory.

Attack Vector

An attacker authenticates to MySQL with high privileges, then interacts with the replication protocol over the network. Because the vulnerability is exploitable through multiple protocols, exposure is not limited to a single client interface. No user interaction is required to complete the attack.

See the Oracle July 2026 Security Alert for the vendor advisory. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-47023

Indicators of Compromise

Unexpected MySQL Server or MySQL Cluster process hangs, restarts, or crash dumps correlated with replication activity
Repeated abnormal disconnects on replication channels from high-privileged accounts
Sudden spikes in resource utilization such as memory or file descriptors on the MySQL host prior to service failure

Detection Strategies

Correlate MySQL error log entries showing replication thread failures with authentication logs identifying the initiating account
Monitor performance_schema and information_schema for anomalous replication events and thread states
Alert on repeated mysqld service restarts or systemd unit failures on database hosts

Monitoring Recommendations

Enable the general query log or audit plugin on replication endpoints to capture privileged session activity
Forward MySQL error logs, audit logs, and host telemetry to a centralized SIEM for correlation
Track privileged account usage patterns, focusing on accounts holding REPLICATION SLAVE, REPLICATION CLIENT, or SUPER privileges

How to Mitigate CVE-2026-47023

Immediate Actions Required

Apply the fixes contained in the Oracle July 2026 Critical Patch Update to all affected MySQL Server and MySQL Cluster instances
Inventory database hosts and identify versions matching MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1, or MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1
Audit accounts holding high privileges and revoke unnecessary replication or administrative rights

Patch Information

Oracle addressed CVE-2026-47023 in the July 2026 Critical Patch Update. Administrators should upgrade to a fixed release identified in the Oracle advisory. Coordinate patching with replication topology maintenance windows to prevent secondary outages.

Workarounds

Restrict network access to MySQL replication ports using host firewalls or network access control lists
Enforce least-privilege access by removing broad administrative rights from application service accounts
Rotate credentials for high-privileged MySQL accounts and enable multi-factor authentication on jump hosts used to reach database servers

bash

# Example: restrict MySQL port 3306 to trusted replication peers only
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Example: revoke unnecessary replication privileges
mysql> REVOKE REPLICATION SLAVE, REPLICATION CLIENT ON *.* FROM 'app_user'@'%';
mysql> FLUSH PRIVILEGES;