CVE-2026-47064: MySQL Server DoS Vulnerability

CVE-2026-47064 Overview

CVE-2026-47064 is a denial of service vulnerability in the Optimizer component of Oracle MySQL Server and MySQL Cluster. A low-privileged attacker with network access can exploit this flaw through multiple protocols to trigger a hang or repeatable crash. Successful exploitation results in a complete denial of service of the affected database instance. The issue is classified under [CWE-284] (Improper Access Control) and was disclosed as part of the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
An authenticated remote attacker can crash or hang MySQL Server and MySQL Cluster instances, producing a complete availability outage for dependent applications.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10
MySQL Server versions 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-47064 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47064

Vulnerability Analysis

The vulnerability resides in the MySQL Optimizer, the subsystem responsible for parsing SQL statements and producing execution plans. An attacker with valid low-privilege credentials can submit a crafted query or connection sequence that causes the Optimizer to hang or crash the server process. The flaw is exposed over multiple protocols supported by MySQL, which broadens the reachable attack surface in typical deployments. Oracle categorizes the issue as easily exploitable, and repeated triggering produces a complete denial of service against the database service.

Root Cause

Oracle's advisory attributes the defect to the Optimizer component and maps it to [CWE-284] Improper Access Control. The Optimizer accepts input from an authenticated session without enforcing sufficient constraints, allowing operations that lead to an unrecoverable state. Oracle has not publicly disclosed the specific code path, and no proof-of-concept has been released.

Attack Vector

Exploitation requires network reachability to the MySQL listener and any valid low-privileged account. The attacker sends a crafted SQL workload or protocol interaction that reaches the Optimizer and causes the server to hang or crash. No user interaction is required, and the attack does not depend on local access. The impact is limited to availability; confidentiality and integrity are not affected. See the Oracle Security Alert July 2026 for the vendor's canonical description.

No verified public exploit code is available, so the vulnerability mechanism is described in prose rather than reproduced here.

Detection Methods for CVE-2026-47064

Indicators of Compromise

Unexpected mysqld process crashes, restarts, or hangs on MySQL Server 8.4.x, 9.7.x, or MySQL Cluster 8.0.x/8.4.x/9.7.x hosts.
Repeated connection or query patterns from a single authenticated account preceding a server hang.
Error log entries referencing Optimizer failures, assertion failures, or abnormal termination of mysqld.

Detection Strategies

Monitor MySQL error logs (log_error) and system journal entries for repeated mysqld termination events correlated with specific client sessions.
Enable and review the MySQL general query log or Performance Schema statement history for anomalous queries submitted immediately before crash events.
Correlate application-side database connectivity errors with server-side crash timestamps to identify the source account and client IP.

Monitoring Recommendations

Alert on mysqld restart frequency exceeding baseline within short time windows.
Track authenticated sessions from low-privilege accounts that generate execution plan failures or query timeouts at elevated rates.
Ingest MySQL audit logs into a centralized SIEM to preserve query context after a crash, since crash conditions may truncate local logs.

How to Mitigate CVE-2026-47064

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all MySQL Server 8.4.x, 9.7.x, and MySQL Cluster instances in the affected version ranges.
Inventory database accounts and remove or restrict any low-privilege accounts that do not require network reachability.
Restrict network access to the MySQL listener using firewall rules or security groups so only trusted application hosts can connect.

Patch Information

Oracle addressed CVE-2026-47064 in the Oracle Critical Patch Update Advisory - July 2026. Administrators should upgrade MySQL Server to a fixed release above 8.4.10 or 9.7.1, and MySQL Cluster to a fixed release above 8.0.47, 8.4.10, or 9.7.1 as specified in the advisory. Oracle does not publish standalone patches outside the quarterly CPU cycle for these components.

Workarounds

Enforce least-privilege on all MySQL accounts and audit GRANT statements to remove unnecessary connection privileges.
Place MySQL behind a network segmentation boundary and require VPN or bastion access for administrative and application connections.
Configure connection rate limits and query timeouts (max_execution_time, max_user_connections) to reduce the impact of abusive sessions until the patch is applied.

bash

# Configuration example: restrict connections and cap query execution time
# /etc/mysql/mysql.conf.d/mysqld.cnf
[mysqld]
bind-address = 10.0.0.10
max_user_connections = 25
max_execution_time = 5000   # milliseconds