CVE-2026-60324: MySQL Server Optimizer DoS Vulnerability

CVE-2026-60324 Overview

CVE-2026-60324 is a denial of service vulnerability in the Optimizer component of Oracle MySQL Server and MySQL Cluster. Oracle disclosed the flaw in the July 2026 Critical Patch Update. Affected versions include MySQL Server 9.7.0-9.7.1 and MySQL Cluster 9.7.0-9.7.1. A low-privileged attacker with network access can exploit the vulnerability through multiple protocols to trigger a hang or repeatable crash of the database service. The flaw carries a CVSS 3.1 base score of 6.5 with availability-only impact.

Critical Impact
Successful exploitation causes a complete denial of service against MySQL Server or MySQL Cluster instances, resulting in database hangs or repeatable crashes that disrupt dependent applications.

Affected Products

Oracle MySQL Server versions 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 9.7.0 through 9.7.1
Optimizer component of the MySQL Server subsystem

Discovery Timeline

2026-07-21 - CVE-2026-60324 published to the National Vulnerability Database
2026-07-21 - Oracle released the July 2026 Critical Patch Update addressing the issue
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60324

Vulnerability Analysis

The vulnerability resides in the MySQL Server Optimizer, the subsystem responsible for parsing SQL statements and selecting execution plans. An authenticated attacker holding low-level database privileges can send crafted SQL queries that trigger unsafe conditions during query planning. The result is a database hang or a repeatable crash producing complete denial of service.

Oracle classifies the flaw as easily exploitable and reachable across multiple protocols supported by MySQL Server, including standard MySQL client connections. The attack requires no user interaction and no elevated privileges beyond a valid low-privilege account. The scope remains unchanged, and confidentiality and integrity are not affected, but availability impact is high.

Both standalone MySQL Server 9.7.0-9.7.1 and MySQL Cluster 9.7.0-9.7.1 deployments share the vulnerable Optimizer code path. Environments that expose the MySQL service to authenticated users, applications, or web tiers with database credentials are within reach of exploitation.

Root Cause

Oracle has not published detailed root-cause analysis. Based on the advisory metadata, the defect exists in query optimization logic within the Server: Optimizer component. Malformed or edge-case query structures cause the optimizer to enter a state that either loops indefinitely or dereferences unexpected data, terminating the process. Refer to the Oracle Critical Patch Update July 2026 for vendor-supplied context.

Attack Vector

The attack originates over the network. An attacker authenticates to a MySQL instance using any valid low-privilege account, including accounts limited to a single application schema. The attacker then issues one or more specifically structured SQL statements that reach the vulnerable optimizer path. Repeated submission of the crafted query keeps the target unavailable, effectively locking legitimate applications out of the database tier.

No verified proof-of-concept exploit is publicly available at the time of publication. The EPSS score is 0.235% with a percentile of 14.46 as of 2026-07-23.

Detection Methods for CVE-2026-60324

Indicators of Compromise

Unexpected mysqld process crashes or repeated restarts recorded in the MySQL error log or systemd journal
Sustained query stalls associated with a single session or repeated identical query patterns from a low-privilege account
Spikes in aborted connections and Threads_running counters coinciding with specific client sources
Application-tier errors indicating loss of database connectivity following authenticated query bursts

Detection Strategies

Monitor MySQL error logs for repeated fatal signals, assertion failures, or stack traces referencing optimizer functions
Enable the MySQL general query log or audit log on sensitive instances and review queries preceding a crash
Correlate database restart events with authentication events to identify the account and source host issuing the trigger queries
Deploy database activity monitoring rules that flag anomalous query complexity or repeated identical failing statements

Monitoring Recommendations

Alert on any mysqld service restart in production and staging environments
Track connection source IPs for accounts that should only connect from known application hosts
Baseline query volume per account and alert when a low-privilege account issues sustained query loads that deviate from normal patterns
Forward MySQL audit events into a centralized SIEM or data lake to enable cross-source correlation with application errors

How to Mitigate CVE-2026-60324

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all MySQL Server and MySQL Cluster instances running 9.7.0 or 9.7.1
Inventory database accounts and remove or restrict low-privilege accounts that are no longer required
Restrict network exposure of MySQL ports so that only trusted application hosts can reach the service
Enable audit logging on internet-adjacent or multi-tenant MySQL deployments to preserve forensic evidence

Patch Information

Oracle addressed CVE-2026-60324 in the Oracle Critical Patch Update July 2026. Administrators should upgrade MySQL Server and MySQL Cluster past the affected 9.7.0-9.7.1 range using the fixed versions listed in the advisory. Cluster deployments must patch all data, SQL, and management nodes to ensure consistent protection.

Workarounds

Enforce network segmentation and firewall rules that limit MySQL access to authorized application subnets
Rotate credentials for any low-privilege accounts that were previously exposed to untrusted networks
Configure connection rate limiting and per-user resource limits such as max_user_connections and max_queries_per_hour to reduce the blast radius of abusive sessions
Failover-ready replica topologies can reduce downtime while the crash trigger is investigated, but patching remains the only complete remediation

bash

# Configuration example: restrict low-privilege account resource usage
mysql> ALTER USER 'app_reader'@'10.20.%'
         WITH MAX_QUERIES_PER_HOUR 1000
              MAX_USER_CONNECTIONS 20;

# Restrict network exposure at the host level
$ sudo iptables -A INPUT -p tcp --dport 3306 \
    -s 10.20.0.0/16 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 3306 -j DROP