CVE-2026-61093 Overview
CVE-2026-61093 is a denial of service vulnerability in the Optimizer component of Oracle MySQL Server and MySQL Cluster. The flaw affects MySQL Server versions 9.7.0 through 9.7.1 and MySQL Cluster versions 9.7.0 through 9.7.1. A low-privileged attacker with network access can exploit the issue over multiple protocols to cause a hang or a frequently repeatable crash. Successful exploitation results in a complete denial of service of the database instance.
Critical Impact
Authenticated network attackers can trigger a complete denial of service against MySQL Server and MySQL Cluster deployments running affected versions.
Affected Products
- Oracle MySQL Server versions 9.7.0 through 9.7.1
- Oracle MySQL Cluster versions 9.7.0 through 9.7.1
- Server: Optimizer component
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-61093 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle addressed the vulnerability in the Oracle Security Alert July 2026
Technical Details for CVE-2026-61093
Vulnerability Analysis
The vulnerability resides in the MySQL Server Optimizer, the component responsible for producing execution plans for SQL statements. An authenticated attacker with low privileges can submit crafted queries that force the Optimizer into a hang state or trigger a repeatable crash of the server process. Because MySQL Cluster shares the same query processing stack, both products are affected under the same version range.
The issue impacts availability only. Data confidentiality and integrity remain intact, and no data disclosure or modification occurs. However, the ability to reliably crash or hang the database process means an attacker can render dependent applications unusable until the service is restarted.
The Exploit Prediction Scoring System (EPSS) currently places this vulnerability at a probability of 0.393%, indicating a low near-term likelihood of observed exploitation. No public proof-of-concept code is available at this time.
Root Cause
The root cause is an unsafe handling path within the Optimizer that fails to gracefully process certain query structures. Instead of rejecting or safely aborting the malformed plan, the Optimizer enters a state that either loops indefinitely or dereferences unexpected state, resulting in a crash of the mysqld process.
Attack Vector
Exploitation requires network access to the MySQL service and a valid low-privileged account. The attacker sends malicious SQL statements over any supported MySQL protocol. Repeated submission of the triggering query pattern produces a repeatable crash or hang, making the denial of service condition reliable and easy to reproduce.
No user interaction is required. Because MySQL Cluster nodes process queries similarly, an attacker who can authenticate to any accessible SQL node can disrupt the cluster.
Detection Methods for CVE-2026-61093
Indicators of Compromise
- Unexpected mysqld process crashes or restarts logged in the MySQL error log
- Repeated query timeouts or long-running queries originating from the same low-privileged account
- Unusual spikes in Optimizer CPU consumption preceding a service hang
- MySQL Cluster nodes reporting SQL node failures without hardware or network cause
Detection Strategies
- Monitor MySQL error logs for repeated abnormal terminations of the server process and correlate them with the executing session and query
- Enable the MySQL general query log or audit plugin on sensitive instances to capture the SQL text that immediately precedes a crash
- Baseline query execution times and alert on unusual query patterns from accounts that typically issue only routine statements
Monitoring Recommendations
- Track database availability with external health checks and alert on repeated connection failures
- Alert on any authenticated session that triggers more than one server restart within a short interval
- Forward MySQL audit and error logs to a centralized logging platform for correlation with authentication events
How to Mitigate CVE-2026-61093
Immediate Actions Required
- Apply the fixes referenced in the Oracle Security Alert July 2026 to all MySQL Server and MySQL Cluster instances at version 9.7.0 or 9.7.1
- Restrict network access to MySQL listeners so that only trusted application hosts can reach the service
- Review and reduce privileges of database accounts, especially those exposed to application tiers or external integrations
- Rotate credentials for any low-privileged accounts whose activity cannot be attributed
Patch Information
Oracle addressed CVE-2026-61093 in the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server and MySQL Cluster beyond the affected 9.7.0-9.7.1 range using the fixed release identified in the Oracle Security Alert July 2026.
Workarounds
- Place MySQL instances behind network access controls that permit connections only from known application servers
- Enforce the principle of least privilege and remove unused database accounts to shrink the pool of accounts that can reach the Optimizer
- Deploy a database firewall or query proxy that can rate-limit or block repeated malformed statements from a single session
- Configure automated service supervision so that crashed mysqld processes restart quickly while alerts fire for investigation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
