CVE-2026-60624: MySQL Connector/J DOS Vulnerability

CVE-2026-60624 Overview

CVE-2026-60624 is a denial-of-service vulnerability affecting the Oracle MySQL Connectors product, specifically the Connector/J component. Supported versions 9.7.0 through 9.7.1 are affected. An unauthenticated attacker with network access via multiple protocols can exploit this flaw to trigger a hang or a frequently repeatable crash, resulting in a complete denial of service of MySQL Connectors. Successful exploitation requires human interaction from a user other than the attacker. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation causes a complete denial of service of MySQL Connector/J, disrupting Java applications that rely on the connector for database access.

Affected Products

Oracle MySQL Connectors 9.7.0
Oracle MySQL Connectors 9.7.1
Java applications using MySQL Connector/J in the affected version range

Discovery Timeline

2026-07-21 - CVE-2026-60624 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database
July 2026 - Oracle addresses the vulnerability in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60624

Vulnerability Analysis

The vulnerability resides in Oracle MySQL Connector/J, the official Java Database Connectivity (JDBC) driver for MySQL. The flaw permits an unauthenticated remote attacker to compromise the availability of the connector when a user is induced to interact with attacker-controlled input or a malicious network resource. Impacted deployments experience a hang or a reliably repeatable crash of the connector process, which halts JDBC-dependent workloads. Confidentiality and integrity are not impacted according to the CVSS vector; only availability is affected. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.334% with a percentile of 25.77 as of 2026-07-23, indicating low expected exploitation activity in the near term.

Root Cause

Oracle has not published detailed root-cause information in the public advisory. The advisory characterizes the issue as an availability defect in Connector/J reachable over the network with low attack complexity. The requirement for user interaction suggests the vulnerable code path is triggered when a client-side JDBC operation processes attacker-influenced data or connects to an attacker-influenced endpoint.

Attack Vector

The attack originates over the network and does not require prior authentication. The attacker must convince a legitimate user or process to initiate an action that causes Connector/J to handle malicious input, for example by connecting to a rogue MySQL endpoint or processing crafted server responses. Once triggered, the connector hangs or crashes, denying service to dependent Java applications. Refer to the Oracle Critical Patch Update July 2026 advisory for further technical context.

Detection Methods for CVE-2026-60624

Indicators of Compromise

Repeated JVM thread hangs or unhandled exceptions originating from com.mysql.cj packages in application logs
Sudden termination or unresponsiveness of Java processes shortly after establishing a JDBC connection to an untrusted host
Outbound MySQL protocol (TCP/3306) connections from application servers to unexpected destinations

Detection Strategies

Inventory Java applications and identify those bundling mysql-connector-j versions 9.7.0 or 9.7.1 using software composition analysis
Alert on unexpected crash loops or restarts of Java services that use Connector/J
Monitor JDBC connection strings and configuration files for references to untrusted MySQL hosts

Monitoring Recommendations

Forward JVM crash logs and application error logs to a centralized logging platform for correlation
Track outbound network flows from application tiers to enforce allowlisting of authorized MySQL servers
Baseline normal Connector/J behavior and alert on deviations such as sustained thread blockage or repeated fatal errors

How to Mitigate CVE-2026-60624

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to upgrade Connector/J beyond the affected 9.7.0-9.7.1 range
Identify all deployed Java artifacts and container images that ship the vulnerable connector version
Restrict outbound MySQL connectivity from application servers to known, trusted database endpoints

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update July 2026 advisory and upgrade mysql-connector-j to the fixed version specified by Oracle. Rebuild and redeploy Java applications and container images that embed the connector.

Workarounds

Enforce network-level allowlisting so that Java applications can only reach approved MySQL servers
Educate users and operators to avoid initiating JDBC connections to untrusted MySQL endpoints or files
Isolate JDBC-dependent workloads in resource-limited containers so that a crash does not impact the wider host

bash

# Example: identify vulnerable Connector/J JARs on a host
find / -type f -name 'mysql-connector-j-*.jar' 2>/dev/null \
  | grep -E 'mysql-connector-j-9\.7\.(0|1)'