CVE-2026-60187: MySQL Server Replication DoS Vulnerability

CVE-2026-60187 Overview

CVE-2026-60187 is a denial-of-service vulnerability affecting Oracle MySQL Server and MySQL Cluster. The flaw resides in the Server: Replication component and is tracked under CWE-400: Uncontrolled Resource Consumption. A high-privileged authenticated attacker with network access via multiple protocols can trigger a hang or a repeatable crash of the database service. Successful exploitation results in a complete availability loss on affected instances. Oracle disclosed the issue in the Oracle Critical Patch Update - July 2026.

Critical Impact
Successful exploitation causes a complete denial of service against MySQL Server and MySQL Cluster instances, hanging or repeatedly crashing the database and disrupting dependent applications.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60187 published to the National Vulnerability Database
2026-07-23 - CVE-2026-60187 last modified in NVD

Technical Details for CVE-2026-60187

Vulnerability Analysis

The vulnerability affects the replication subsystem of MySQL Server and MySQL Cluster. Exploitation requires an authenticated attacker with high privileges on the target instance. The attacker sends crafted input over one of several supported network protocols, causing the server to hang or crash repeatedly. The impact is limited to availability, with no confidentiality or integrity compromise reported by Oracle. Because the replication component is central to high-availability deployments, a crash can cascade across clustered nodes and disrupt downstream consumers of replicated data.

Root Cause

Oracle classifies the weakness as CWE-400: Uncontrolled Resource Consumption. The replication code path fails to bound resource usage or handle malformed replication input safely, allowing a privileged actor to force the server into an unresponsive or crashing state. Oracle has not published deeper technical details beyond the Oracle Critical Patch Update advisory.

Attack Vector

The attack originates over the network and can be delivered through multiple MySQL protocols. The attacker must already possess high privileges on the target, such as an account authorized to interact with replication interfaces. Successful attacks trigger a complete denial of service by hanging or crashing mysqld. No user interaction is required, but exploitation is rated difficult due to the privilege prerequisite and specific protocol conditions.

No public proof-of-concept code has been released for CVE-2026-60187. Refer to the Oracle Security Alert - July 2026 for the authoritative technical description.

Detection Methods for CVE-2026-60187

Indicators of Compromise

Unexpected mysqld process crashes or hangs on replication source or replica nodes running affected versions
Replication threads stopping with errors or entering repeated restart loops on MySQL Cluster nodes
Sudden spikes in replication protocol traffic from authenticated administrative accounts

Detection Strategies

Inventory MySQL Server and MySQL Cluster deployments and flag any instance running versions 8.0.0-8.0.47, 8.4.0-8.4.10, or 9.7.0-9.7.1
Correlate crash events in the MySQL error log with authentication events from high-privileged replication accounts
Alert on repeated mysqld restarts within short time windows on replication-participating hosts

Monitoring Recommendations

Enable audit logging for privileged replication users and forward logs to a centralized SIEM for correlation
Monitor availability metrics (Uptime, Threads_connected, replication lag) to detect service degradation early
Track configuration changes on REPLICATION SLAVE and REPLICATION CLIENT grants to identify unauthorized privilege assignment

How to Mitigate CVE-2026-60187

Immediate Actions Required

Apply the fixes distributed in the Oracle Critical Patch Update - July 2026 to all affected MySQL Server and MySQL Cluster instances
Audit and reduce accounts holding REPLICATION SLAVE, REPLICATION CLIENT, and SUPER privileges to the minimum required
Restrict network access to MySQL replication ports so only trusted replica hosts can connect

Patch Information

Oracle addressed CVE-2026-60187 in the July 2026 Critical Patch Update. Upgrade MySQL Server to a version later than 8.4.10 or 9.7.1 on the respective release lines. Upgrade MySQL Cluster past 8.0.47, 8.4.10, or 9.7.1 depending on the deployed branch. Consult the Oracle Security Alert - July 2026 for exact fixed build numbers and upgrade procedures.

Workarounds

Enforce network segmentation and firewall rules that limit replication protocol access to known replica IP addresses
Rotate credentials for high-privileged replication accounts and require multi-factor authentication for administrative access to database hosts
Increase monitoring on replication topology and prepare failover runbooks until patches are deployed

bash

# Verify installed MySQL version against affected ranges
mysql -V

# List accounts holding replication privileges for review
mysql -uroot -p -e "SELECT user, host FROM mysql.user \
  WHERE Repl_slave_priv='Y' OR Repl_client_priv='Y' OR Super_priv='Y';"

# Restrict replication port at the host firewall (example: iptables)
iptables -A INPUT -p tcp --dport 3306 -s <trusted_replica_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP