CVE-2026-60314: Oracle MySQL Router DoS Vulnerability

CVE-2026-60314 Overview

CVE-2026-60314 is a denial of service vulnerability in Oracle MySQL Router affecting versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. The flaw resides in the Router: General component and is reachable over HTTP without authentication. An unauthenticated remote attacker with network access can send crafted HTTP traffic to trigger a hang or a repeatable crash of the MySQL Router process. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can trigger a complete denial of service against MySQL Router, disrupting database connectivity for downstream applications.

Affected Products

Oracle MySQL Router 8.4.0 through 8.4.10
Oracle MySQL Router 9.7.0 through 9.7.1
Deployments exposing the MySQL Router HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-60314 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60314

Vulnerability Analysis

MySQL Router is a lightweight middleware that routes client connections to backend MySQL InnoDB Cluster or ReplicaSet nodes. The Router exposes an HTTP interface used for REST endpoints and management. This vulnerability allows an unauthenticated attacker to send malformed or specifically crafted HTTP requests that cause the Router process to hang or crash reliably.

Because the Router acts as the connection broker between applications and the database tier, a crash removes the routing layer entirely. Applications lose the ability to resolve backend targets and connect to the cluster until the process is restarted. Repeated exploitation can keep the Router in a persistent outage state.

The vulnerability affects only availability. Confidentiality and integrity are not impacted, and no data disclosure or modification occurs. The issue falls under the Denial of Service class of vulnerabilities.

Root Cause

Oracle has not published root-cause details in the public advisory. The available information from the July 2026 Critical Patch Update indicates that request handling within the Router's HTTP subsystem does not correctly manage certain inputs, leading to a hang or crash condition. See the Oracle Security Alert July 2026 for vendor detail.

Attack Vector

Exploitation requires only network reachability to the MySQL Router HTTP listener. No credentials, user interaction, or prior access are required. The attacker sends HTTP traffic to the exposed Router endpoint and observes process termination or unresponsiveness. Any environment where the Router HTTP interface is reachable from untrusted networks is directly exposed.

No verified public exploit code is available at this time. The EPSS probability is 0.357% (percentile 28.2).

Detection Methods for CVE-2026-60314

Indicators of Compromise

Unexpected termination or restart events for the mysqlrouter process
Application-side database connection failures correlated with Router downtime
Bursts of HTTP requests to the MySQL Router management or REST port from unusual sources
Router log entries showing abnormal request patterns immediately before a crash or hang

Detection Strategies

Monitor MySQL Router process health with liveness checks and alert on repeated restarts within short intervals
Inspect HTTP access logs for anomalous request rates, malformed URIs, or unusual client IP addresses targeting Router endpoints
Correlate Router crash events with upstream network traffic to identify the source of hostile requests

Monitoring Recommendations

Enable verbose logging on the MySQL Router HTTP component to capture request metadata before failures
Forward Router logs and process events to a centralized SIEM for cross-correlation with network telemetry
Track backend cluster connection error rates from applications as an early indicator of Router unavailability

How to Mitigate CVE-2026-60314

Immediate Actions Required

Apply the fixes contained in the Oracle Critical Patch Update of July 2026 to all MySQL Router deployments running affected versions
Restrict network access to the MySQL Router HTTP interface using firewall rules or security groups so only trusted application hosts can connect
Audit exposed Router instances to confirm none are reachable from the public internet

Patch Information

Oracle addressed CVE-2026-60314 in the July 2026 Critical Patch Update. Administrators should upgrade MySQL Router to a fixed release beyond 8.4.10 and 9.7.1 as listed in the Oracle Security Alert July 2026.

Workarounds

Place the MySQL Router HTTP endpoint behind a reverse proxy or WAF that filters malformed requests and enforces rate limits
Bind the Router HTTP interface to a management-only network segment rather than a public interface
Disable the HTTP component in the Router configuration if REST management features are not required in the deployment

bash

# Example: restrict MySQL Router HTTP listener to loopback in mysqlrouter.conf
[http_server]
bind_address=127.0.0.1
port=8443
ssl=1