CVE-2026-60174: MySQL Server & Cluster DoS Vulnerability

CVE-2026-60174 Overview

CVE-2026-60174 is a denial-of-service vulnerability in the Oracle MySQL Server and MySQL Cluster products. The flaw resides in the Server: Optimizer component and affects MySQL Server versions 9.7.0 through 9.7.1 and MySQL Cluster versions 9.7.0 through 9.7.1. A low-privileged attacker with network access can exploit the issue through multiple protocols to trigger a hang or a repeatable crash of the database service. The vulnerability maps to [CWE-400: Uncontrolled Resource Consumption]. Oracle disclosed the issue in the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
Successful exploitation produces a complete denial of service against MySQL Server and MySQL Cluster instances, disrupting dependent applications and data availability.

Affected Products

Oracle MySQL Server versions 9.7.0 to 9.7.1
Oracle MySQL Cluster versions 9.7.0 to 9.7.1
Applications and services relying on the affected database instances

Discovery Timeline

2026-07-21 - CVE-2026-60174 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60174

Vulnerability Analysis

The vulnerability exists in the query optimizer subsystem of MySQL Server and MySQL Cluster. The optimizer analyzes SQL statements to determine execution plans, and malformed or specially crafted queries can force the component into a state of uncontrolled resource consumption. Attackers do not need administrative rights. An authenticated account with basic query privileges is sufficient to reach the vulnerable code path over the network.

Exploitation produces two possible outcomes: the server process hangs and stops responding to new client requests, or it crashes and terminates active sessions. Repeated exploitation blocks legitimate database traffic and halts application workflows dependent on MySQL.

Root Cause

The issue is categorized under [CWE-400: Uncontrolled Resource Consumption]. The optimizer fails to bound resource use when processing certain query structures. Full technical specifics are limited to Oracle's advisory, as Oracle does not publish detailed vulnerability internals for its Critical Patch Update entries. Refer to the Oracle Security Alert July 2026 for vendor context.

Attack Vector

The attack vector is network-based. An attacker authenticates to the MySQL service using a low-privileged account and submits crafted SQL statements through any supported client protocol. Because attack complexity is low and no user interaction is required, exploitation is straightforward once network reachability and valid credentials exist. Exposed database instances that permit broad user authentication are the primary risk.

The vulnerability does not affect confidentiality or integrity. Impact is limited to availability, consistent with denial-of-service behavior.

Detection Methods for CVE-2026-60174

Indicators of Compromise

Sudden MySQL Server or MySQL Cluster process termination without prior operator action
Repeated mysqld restart events in system logs correlated with specific client sessions
Sessions issuing unusually complex or malformed queries followed by connection loss
Spikes in CPU or memory consumption by mysqld triggered by identifiable user accounts

Detection Strategies

Monitor MySQL error logs for abnormal crash signatures and repeated restart cycles
Enable the MySQL general query log or audit plugin to identify statements preceding service failure
Alert on authenticated sessions whose queries exceed configured resource thresholds
Correlate database availability alerts with network flow data to trace the originating client

Monitoring Recommendations

Track mysqld uptime and process health metrics through infrastructure monitoring
Baseline query latency and flag deviations that align with optimizer stalls
Forward MySQL audit logs to a centralized SIEM for correlation with authentication events
Review privilege assignments to identify accounts with unnecessary network query access

How to Mitigate CVE-2026-60174

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster instances
Restrict network access to database ports using firewalls and security groups
Audit MySQL user accounts and revoke privileges from accounts that do not require query access
Enforce strong authentication and rotate credentials for accounts exposed to untrusted networks

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server and MySQL Cluster to a version later than 9.7.1 as specified in the Oracle Security Alert July 2026. Test the update in a staging environment before rolling it to production clusters.

Workarounds

Limit database connectivity to trusted application subnets until patching is complete
Reduce query resource limits using max_execution_time and per-user resource controls
Disable unused client protocols to shrink the reachable attack surface
Deploy a database proxy or firewall capable of rate-limiting suspicious query patterns

bash

# Example: restrict per-user resource usage in MySQL
ALTER USER 'app_user'@'%' 
  WITH MAX_QUERIES_PER_HOUR 1000 
       MAX_UPDATES_PER_HOUR 200 
       MAX_CONNECTIONS_PER_HOUR 100 
       MAX_USER_CONNECTIONS 10;

# Set a global query execution timeout (milliseconds)
SET GLOBAL max_execution_time = 15000;