CVE-2026-60311: MySQL Server & Cluster DoS Vulnerability

CVE-2026-60311 Overview

CVE-2026-60311 is a denial of service vulnerability affecting the Optimizer component of Oracle MySQL Server and MySQL Cluster. The flaw allows a low-privileged attacker with network access via multiple protocols to trigger a hang or repeatable crash of the database service. Affected versions include MySQL Server 9.0.0 through 9.7.1 and MySQL Cluster 9.0.0 through 9.7.1. The weakness is classified under [CWE-400] Uncontrolled Resource Consumption. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can crash or hang MySQL Server and MySQL Cluster instances remotely, producing a complete denial of service against affected databases.

Affected Products

Oracle MySQL Server versions 9.0.0 through 9.7.1
Oracle MySQL Cluster versions 9.0.0 through 9.7.1
Deployments exposing MySQL protocols to authenticated network clients

Discovery Timeline

2026-07-21 - CVE-2026-60311 published to the National Vulnerability Database
2026-07-23 - Record last modified in NVD

Technical Details for CVE-2026-60311

Vulnerability Analysis

The vulnerability resides in the MySQL Server Optimizer, the subsystem responsible for query planning and execution strategy selection. A malformed or crafted query pattern causes the Optimizer to consume resources without bound or reach an unrecoverable state. The result is either a service hang or a repeatable crash that terminates the mysqld process.

The issue is remotely reachable over the network and does not require user interaction. An attacker needs only low-level authenticated access, such as a standard application account, to send the triggering payload. Because MySQL Cluster shares the affected component, distributed deployments are equally exposed.

Successful exploitation produces a complete availability loss. Confidentiality and integrity are not directly affected, but downstream applications that depend on the database inherit the outage.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] within the Optimizer code path. Query structures that the planner fails to bound or validate lead to excessive memory or CPU use, or to an internal assertion failure. Oracle has not disclosed the specific optimizer routine at fault.

Attack Vector

Exploitation occurs over the network using MySQL client protocols. The attacker authenticates with a low-privilege account, then submits the malformed query. Because the Optimizer runs before result processing, no schema privileges beyond basic access are required to trigger the fault.

No verified public exploit code is available. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60311

Indicators of Compromise

Unexpected mysqld process crashes or restarts logged by the operating system service manager
MySQL error log entries referencing signal handling, assertion failures, or Optimizer stack traces
Sudden spikes in CPU or memory attributed to a single connection prior to service termination
Connection loss reported by dependent applications shortly after a specific client query

Detection Strategies

Monitor MySQL error logs for repeated crash signatures and correlate them with the originating client account and source IP
Enable the slow query log and general query log at elevated verbosity in non-production tiers to capture query patterns that precede crashes
Alert on mysqld process restarts, replication link resets, and cluster failover events that lack a planned maintenance window

Monitoring Recommendations

Track query execution latency and Optimizer statistics through performance_schema for anomalous plan generation times
Forward MySQL audit and error logs to a centralized SIEM and build detections for repeated crashes tied to a single authenticated user
Baseline normal query patterns for each application account and flag deviations that coincide with service instability

How to Mitigate CVE-2026-60311

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all MySQL Server and MySQL Cluster instances running 9.0.0 through 9.7.1
Inventory database accounts and remove or rotate credentials for unused low-privilege users that could be abused to reach the Optimizer
Restrict network exposure of MySQL listeners to trusted application subnets using firewall rules or security groups
Verify backup and replication health so that a crash-induced outage can be recovered without data loss

Patch Information

Oracle addressed CVE-2026-60311 in the July 2026 Critical Patch Update. Upgrade MySQL Server and MySQL Cluster to a fixed release beyond 9.7.1 as identified in the Oracle Security Alert July 2026. Coordinate patching with cluster failover procedures to minimize downtime.

Workarounds

Limit database account privileges to the minimum required and disable network access for accounts that do not need it
Place MySQL behind a proxy such as ProxySQL or MySQL Router and enforce query filtering rules that block unexpected statement patterns
Enable process supervision so mysqld restarts automatically after a crash while patching is scheduled
Isolate management interfaces on a dedicated administrative network segment

bash

# Example: restrict MySQL listener to an internal subnet and enforce a bind address
# /etc/mysql/mysql.conf.d/mysqld.cnf
[mysqld]
bind-address = 10.0.10.25
skip-networking = OFF
max_connections = 200

# Example: iptables rule limiting access to an application subnet
iptables -A INPUT -p tcp --dport 3306 -s 10.0.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP