CVE-2026-60184 Overview
CVE-2026-60184 is a denial of service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. The flaw allows a high-privileged attacker with network access via multiple protocols to cause a hang or repeatable crash of the database service. Affected versions include MySQL Server 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, along with MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. Oracle addressed the issue in the July 2026 Critical Patch Update. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption).
Critical Impact
Successful exploitation results in complete denial of service against MySQL Server or MySQL Cluster instances, disrupting availability for all connected applications.
Affected Products
- Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
- Oracle MySQL Cluster versions 8.0.0 through 8.0.47
- Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60184 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60184
Vulnerability Analysis
The vulnerability resides in the Replication component of MySQL Server and MySQL Cluster. An attacker with high privileges on the database can send crafted input over the network to trigger a hang or a repeatable crash. The impact is confined to availability, with no confidentiality or integrity consequences. Because replication is a core mechanism for high-availability deployments, exploitation directly degrades the reliability guarantees these architectures are designed to provide.
Root Cause
The issue is categorized as CWE-400, Uncontrolled Resource Consumption. Replication logic fails to bound resource use when processing specific inputs, allowing the server process to enter an unrecoverable state. Repeated exploitation produces a complete denial of service for the affected instance.
Attack Vector
Exploitation requires network access and existing high-privilege credentials on the target database. The attacker can leverage multiple protocols exposed by MySQL to reach the vulnerable code path. The attack complexity is high, which reflects specific timing or configuration conditions required to reliably trigger the crash. Oracle references the issue in the Oracle Security Alert - July 2026.
No verified public proof-of-concept code is available. Refer to the vendor advisory for technical details on the affected code paths.
Detection Methods for CVE-2026-60184
Indicators of Compromise
- Unexpected MySQL server hangs or repeated mysqld process crashes correlated with replication traffic
- Replication threads stuck in unusual states visible via SHOW SLAVE STATUS or SHOW REPLICA STATUS
- Abnormal spikes in resource consumption on replication endpoints prior to service failure
Detection Strategies
- Monitor MySQL error logs for repeated crash signatures and stack traces referencing replication subsystems
- Correlate authenticated high-privilege sessions with subsequent replication anomalies or service restarts
- Alert on repeated instances of mysqld restart events on production database hosts
Monitoring Recommendations
- Track replication lag, thread state, and connection origin for privileged replication accounts
- Ingest MySQL audit and error logs into a centralized platform for anomaly analysis
- Baseline normal replication traffic patterns and alert on deviations from privileged sources
How to Mitigate CVE-2026-60184
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all affected MySQL Server and MySQL Cluster instances
- Audit accounts holding replication and administrative privileges and revoke any that are not required
- Restrict network reachability of MySQL replication ports to trusted management and replica hosts only
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server to a version beyond 8.4.10 or 9.7.1 as specified in the Oracle Security Alert - July 2026, and update MySQL Cluster deployments to a fixed release beyond 8.0.47, 8.4.10, or 9.7.1.
Workarounds
- Enforce network segmentation and firewall rules that limit MySQL protocol access to known replica and administrative hosts
- Rotate credentials for high-privilege accounts and enforce strong authentication controls
- Enable database auditing to record privileged session activity that could precede exploitation attempts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
