CVE-2026-60180: MySQL Connector/C++ DoS Vulnerability

CVE-2026-60180 Overview

CVE-2026-60180 is a denial-of-service vulnerability in the Oracle MySQL Connectors product, specifically the Connector/C++ component. Supported versions 9.7.0 through 9.7.1 are affected. The flaw allows an unauthenticated remote attacker to compromise availability through multiple network protocols. Successful exploitation causes a hang or a repeatable crash, resulting in complete denial of service of the connector. The weakness is classified as [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated network attackers can trigger a complete denial of service against Oracle MySQL Connector/C++ 9.7.0–9.7.1, causing hangs or repeatable crashes that disrupt application connectivity to MySQL databases.

Affected Products

Oracle MySQL Connectors, Connector/C++ version 9.7.0
Oracle MySQL Connectors, Connector/C++ version 9.7.1
Applications and services that link against the affected Connector/C++ builds

Discovery Timeline

2026-07-21 - CVE-2026-60180 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60180

Vulnerability Analysis

The vulnerability resides in Oracle MySQL Connector/C++, the native C++ client library used by applications to communicate with MySQL servers. An unauthenticated attacker with network access can send crafted traffic over one of several supported protocols to trigger the flaw. Exploitation does not require user interaction or prior credentials. The connector enters either an unrecoverable hang state or a repeatable crash, which halts all database operations that depend on it. The Exploit Prediction Scoring System (EPSS) currently rates the likelihood of exploitation in the wild as low.

Root Cause

The underlying weakness is Uncontrolled Resource Consumption [CWE-400]. The Connector/C++ code fails to properly bound resource use when processing specific network inputs. Malformed or adversarial protocol messages drive the connector into a state where it either loops indefinitely or dereferences invalid state, terminating the process. Oracle has not published a detailed technical breakdown beyond the availability-only impact classification.

Attack Vector

The attack vector is network based and requires low attack complexity. An attacker positioned to send traffic to a client using Connector/C++, or to a service that proxies untrusted input into the connector, can trigger the condition. Because the connector supports multiple protocols, the attack surface is broad in typical middleware and application-server deployments. Successful attacks compromise only availability; confidentiality and integrity are not impacted.

No public proof-of-concept exploit is currently available. Technical details are limited to the vendor advisory in the Oracle Security Alert July 2026.

Detection Methods for CVE-2026-60180

Indicators of Compromise

Repeated abnormal termination or unresponsiveness of processes linked against libmysqlcppconn or mysqlcppconnx at versions 9.7.0 or 9.7.1
Sudden increases in dropped or reset MySQL client connections from application tiers
Application logs showing connector-level hangs, timeouts, or segmentation faults without corresponding server-side query errors

Detection Strategies

Inventory hosts and containers for Oracle MySQL Connector/C++ binaries and confirm installed versions against the affected range
Correlate application crash telemetry with inbound network traffic patterns targeting database client processes
Monitor for anomalous protocol traffic directed at services that embed Connector/C++, including malformed handshake or authentication packets

Monitoring Recommendations

Alert on process restarts and abnormal exit codes for services that depend on the affected connector
Track connection pool exhaustion and rising database client error rates as potential DoS indicators
Capture network flow data on ports and protocols used by applications embedding Connector/C++ for post-incident analysis

How to Mitigate CVE-2026-60180

Immediate Actions Required

Upgrade Oracle MySQL Connector/C++ to the fixed release identified in the July 2026 Oracle Critical Patch Update
Restrict network exposure of application services that use the affected connector to trusted sources only
Rebuild and redeploy any statically linked applications after updating the connector library

Patch Information

Oracle addressed CVE-2026-60180 as part of the July 2026 Critical Patch Update cycle. Refer to the Oracle Security Alert July 2026 for the specific fixed versions and download locations. Apply the vendor-supplied update to all systems running Connector/C++ 9.7.0 or 9.7.1.

Workarounds

Place affected applications behind network controls that filter untrusted MySQL protocol traffic
Enforce mutual TLS or IP allow-listing on database client endpoints where feasible
Configure process supervision to automatically restart crashed services while the patch is being rolled out

bash

# Verify installed Connector/C++ version on Linux
dpkg -l | grep -i mysql-connector-c++
rpm -qa | grep -i mysql-connector-c++
ldconfig -p | grep -Ei 'mysqlcppconn|mysqlcppconnx'