CVE-2026-60185: MySQL Server/Cluster DoS Vulnerability

CVE-2026-60185 Overview

CVE-2026-60185 is a denial of service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. A high-privileged attacker with network access can exploit this flaw across multiple protocols to hang or repeatedly crash the database service. The vulnerability is classified under [CWE-400] (Uncontrolled Resource Consumption). Successful exploitation results in complete availability loss for the affected MySQL Server or MySQL Cluster instance, though confidentiality and integrity remain intact.

Critical Impact
Successful exploitation causes a hang or frequently repeatable crash resulting in complete denial of service of MySQL Server and MySQL Cluster instances.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60185 published to NVD
2026-07-23 - Last updated in NVD database
2026-07 - Addressed in Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60185

Vulnerability Analysis

The vulnerability resides in the MySQL Server Replication subsystem, which handles data synchronization between primary and replica database nodes. An attacker with high privileges and network access to the database can trigger uncontrolled resource consumption through crafted replication traffic. The flaw enables the attacker to cause the server process to hang or crash in a reproducible manner.

Exploitation requires authenticated access with elevated privileges and involves conditions beyond the attacker's direct control. Despite the difficulty, the outcome is a complete denial of service against production database infrastructure. The vulnerability is exploitable via multiple protocols supported by MySQL, expanding the attack surface for authenticated adversaries.

The EPSS probability for exploitation is 0.336%, reflecting low observed exploit activity at disclosure.

Root Cause

The root cause maps to [CWE-400], Uncontrolled Resource Consumption, within the Replication component. The server fails to properly bound or manage resources when processing specific replication operations. This allows a privileged actor to force the server into an unrecoverable state or repeatable crash loop.

Attack Vector

The attack is delivered over the network by an authenticated user holding replication-relevant privileges. Because exploitation targets a core database availability guarantee, downstream applications relying on MySQL become unavailable. No user interaction is required to trigger the crash once the malicious replication input is submitted.

No public proof-of-concept code is available for CVE-2026-60185. Refer to the Oracle Security Alert July 2026 for authoritative technical context.

Detection Methods for CVE-2026-60185

Indicators of Compromise

Unexpected MySQL Server or mysqld process crashes with restart loops on affected versions
Replication threads entering hung states or terminating abnormally in SHOW REPLICA STATUS output
Sudden spikes in resource usage (CPU, memory, file descriptors) on replication endpoints
Repeated authentication events from high-privileged replication accounts preceding crashes

Detection Strategies

Monitor MySQL error logs for repeated fatal signals, assertion failures, or replication thread aborts
Correlate MySQL crash events with recent authenticated sessions from privileged accounts
Baseline normal replication traffic patterns and alert on anomalous protocol usage or malformed requests

Monitoring Recommendations

Enable audit logging for administrative and replication-privileged account activity
Track service availability metrics for MySQL Server and MySQL Cluster nodes with alerting on repeated restarts
Forward MySQL logs into a centralized analytics platform to correlate crashes with user activity and network sources

How to Mitigate CVE-2026-60185

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all affected MySQL Server and MySQL Cluster instances
Inventory database deployments to identify versions in the affected ranges (8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1)
Restrict network access to MySQL replication ports to trusted management networks only
Review and reduce the number of accounts holding high-level replication privileges

Patch Information

Oracle addressed CVE-2026-60185 in the July 2026 Critical Patch Update. Full remediation details and version-specific patches are available in the Oracle Security Alert July 2026. Upgrade MySQL Server beyond 8.4.10 and 9.7.1, and MySQL Cluster beyond 8.0.47, 8.4.10, and 9.7.1.

Workarounds

Enforce strict privilege separation and revoke unnecessary REPLICATION SLAVE and administrative grants
Place MySQL replication endpoints behind network segmentation and mutual TLS where supported
Implement rate limiting and connection controls on database ports to slow abusive authenticated sessions

bash

# Verify installed MySQL version and identify affected instances
mysql -u admin -p -e "SELECT VERSION();"

# Review replication-privileged accounts
mysql -u admin -p -e "SELECT user, host FROM mysql.user WHERE Repl_slave_priv='Y' OR Super_priv='Y';"

# Restrict MySQL port access at the host firewall (Linux example)
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP