CVE-2026-47052: MySQL Server InnoDB DOS Vulnerability

CVE-2026-47052 Overview

CVE-2026-47052 is a denial-of-service vulnerability in the InnoDB component of Oracle MySQL Server and MySQL Cluster. A high-privileged attacker with network access can trigger a hang or repeatable crash of the database service, resulting in complete availability loss. The vulnerability affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, along with MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle disclosed the issue in the July 2026 Critical Patch Update. The weakness is categorized as [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Successful exploitation causes a complete denial of service against MySQL Server and MySQL Cluster instances, disrupting dependent applications and business processes.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47
Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-47052 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47052

Vulnerability Analysis

The vulnerability resides within the InnoDB storage engine, the default transactional engine used by MySQL Server and MySQL Cluster. InnoDB manages buffer pools, redo logs, undo tablespaces, and row-level locking. A specifically crafted sequence of operations against the engine causes uncontrolled resource consumption, leading to a service hang or a reliably reproducible crash. The impact is limited to availability, with no direct compromise of data confidentiality or integrity. Exploitation requires an authenticated account with high privileges but no user interaction, and the attacker can reach the server over multiple supported protocols.

Root Cause

The root cause is uncontrolled resource consumption within InnoDB request handling, aligning with [CWE-400]. Certain operations are not bounded or properly throttled, allowing an authenticated actor to exhaust internal resources or drive the engine into a state that cannot recover without a restart. Oracle has not released detailed technical internals beyond the July 2026 Critical Patch Update advisory.

Attack Vector

An attacker authenticates to the MySQL Server or MySQL Cluster instance with a high-privilege account, then issues crafted queries or protocol interactions that reach the vulnerable InnoDB code path. Repeated invocation causes the server to hang or crash, producing a repeatable denial of service. Because access is over the network and complexity is low, any exposed instance whose privileged credentials are compromised or misused is at direct risk.

No verified public proof-of-concept code exists. Refer to the Oracle Security Alert July 2026 for authoritative details.

Detection Methods for CVE-2026-47052

Indicators of Compromise

Unexpected mysqld process termination, restart loops, or repeated crash entries in the MySQL error log.
InnoDB stall messages such as long semaphore waits or InnoDB: Warning: a long semaphore wait entries preceding a hang.
Sudden spikes in InnoDB buffer pool, undo log, or thread activity originating from a single authenticated session.

Detection Strategies

Correlate MySQL error log entries with query audit logs to identify the privileged account and statements preceding a crash.
Enable the MySQL Enterprise Audit plugin or general query log for privileged sessions to capture the exact statement sequence.
Alert on abnormal ratios of connection resets or aborted clients against InnoDB instances handling production workloads.

Monitoring Recommendations

Track mysqld uptime, restart counts, and crash exit codes through host telemetry and forward to a central log platform.
Monitor privileged MySQL account activity, especially DDL and administrative statements executed outside change windows.
Baseline InnoDB metrics (Innodb_row_lock_time, Innodb_buffer_pool_wait_free, thread counts) to detect anomalies indicative of exploitation attempts.

How to Mitigate CVE-2026-47052

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster instances.
Inventory all instances running MySQL Server 8.4.x, 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, 9.7.x and prioritize internet-adjacent or business-critical databases.
Rotate credentials for high-privilege MySQL accounts and confirm they are not reused across environments.

Patch Information

Oracle addressed CVE-2026-47052 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 advisory for exact fixed versions and download locations, then plan maintenance windows to upgrade affected MySQL Server and MySQL Cluster deployments.

Workarounds

Restrict network access to MySQL listeners using firewalls, security groups, and bind-address configuration so only trusted hosts can connect.
Enforce least privilege by revoking unnecessary administrative grants and separating operational roles from application roles.
Require strong authentication and audit high-privilege sessions; consider bastion or jump-host access for DBA activity.
Enable resource limits (max_user_connections, max_connections, query timeouts) to reduce the blast radius of abusive sessions.

bash

# Configuration example: restrict MySQL exposure and privileged account use
# /etc/mysql/my.cnf
[mysqld]
bind-address = 10.0.0.25
max_connections = 200
max_user_connections = 20
max_execution_time = 30000

# Revoke unnecessary privileges from an application account
REVOKE SUPER, PROCESS, RELOAD ON *.* FROM 'app_user'@'%';
FLUSH PRIVILEGES;