CVE-2026-61108: MySQL Server & Cluster DoS Vulnerability

CVE-2026-61108 Overview

CVE-2026-61108 is a denial of service vulnerability affecting the GIS (Geographic Information System) component of Oracle MySQL Server and MySQL Cluster. The flaw impacts MySQL Server versions 9.7.0 through 9.7.1 and MySQL Cluster versions 9.7.0 through 9.7.1. A low-privileged attacker with network access can exploit this vulnerability through multiple protocols to cause a hang or repeatable crash of the database service. The vulnerability affects only availability, with no impact on confidentiality or integrity.

Critical Impact
Successful exploitation results in a complete denial of service of MySQL Server or MySQL Cluster, causing database hangs or repeatable crashes that disrupt dependent applications.

Affected Products

Oracle MySQL Server versions 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 9.7.0 through 9.7.1
Deployments exposing MySQL GIS functionality over the network

Discovery Timeline

2026-07-21 - CVE-2026-61108 published to NVD
2026-07-21 - Oracle disclosed the vulnerability in the Oracle Security Alert July 2026
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61108

Vulnerability Analysis

The vulnerability resides in the GIS component of MySQL Server, which handles spatial data types and geometric operations. An authenticated attacker with low privileges can submit crafted queries or spatial payloads that trigger a hang or crash condition in the server process. Exploitation requires network access and can be performed over multiple protocols supported by MySQL, including the native MySQL protocol.

The attack does not require user interaction and has low attack complexity. Only availability is affected — attackers cannot read or modify data through this flaw. However, a complete denial of service disrupts any application relying on the database backend. The EPSS score of 0.289% indicates limited near-term exploitation prediction, though internet-exposed or multi-tenant MySQL deployments face elevated operational risk.

Root Cause

Although Oracle does not publish specific CWE identifiers for this issue, the impact profile is consistent with improper handling of spatial input within the GIS subsystem. Malformed geometry values, coordinate reference system inputs, or spatial function arguments likely trigger an unrecoverable state — either an assertion failure, resource exhaustion, or an unhandled exception in the server process. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Attack Vector

An attacker authenticates to the MySQL instance with any low-privileged account and submits a request that invokes vulnerable GIS functionality. Because the vulnerability is network-reachable and supports multiple protocols, both direct database connections and application-layer connections can serve as delivery paths. In shared hosting, multi-tenant, or SaaS environments where untrusted users hold database credentials, the risk of intentional or accidental triggering is elevated.

No verified public proof-of-concept code is available at the time of publication. Technical exploitation details are described in prose only; see the vendor advisory for authoritative information.

Detection Methods for CVE-2026-61108

Indicators of Compromise

Unexpected MySQL Server or Cluster process crashes with stack traces referencing GIS or spatial functions
Repeated database hangs correlated with queries containing spatial data types such as POINT, POLYGON, GEOMETRY, or spatial functions like ST_*
Sudden increases in connection pool saturation or application timeouts pointing to the database tier

Detection Strategies

Enable MySQL general query log or audit log to capture spatial function usage from low-privilege accounts prior to crash events
Correlate MySQL error log entries (mysqld.err) with process restarts and system-level OOM or signal events
Monitor for anomalous query patterns issued by service accounts that do not normally use GIS functionality

Monitoring Recommendations

Alert on MySQL process restarts and unexpected mysqld exits through host monitoring or systemd unit state changes
Track query error rates and connection failure spikes in application performance monitoring dashboards
Aggregate MySQL logs into a centralized analytics platform to enable historical correlation of GIS query activity and crash events

How to Mitigate CVE-2026-61108

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to MySQL Server and MySQL Cluster instances running versions 9.7.0 or 9.7.1
Inventory database accounts and remove or restrict low-privilege accounts that do not require access to production MySQL instances
Restrict network exposure of MySQL and MySQL Cluster ports to trusted application subnets only

Patch Information

Oracle addressed CVE-2026-61108 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the specific patched versions and installation procedures for MySQL Server and MySQL Cluster deployments.

Workarounds

Revoke the EXECUTE privilege on spatial functions from accounts that do not require GIS operations
Place MySQL behind a proxy or firewall that enforces query allow-listing and blocks unexpected spatial function calls
Implement connection rate limiting and automated service restart policies to reduce dwell time when a crash occurs

bash

# Configuration example: restrict network exposure and enforce least privilege
# 1. Bind MySQL to an internal interface only
# In /etc/mysql/mysql.conf.d/mysqld.cnf
bind-address = 10.0.0.10

# 2. Revoke unused spatial privileges from a low-privilege user
mysql> REVOKE EXECUTE ON FUNCTION mysql.ST_GeomFromText FROM 'app_user'@'%';
mysql> FLUSH PRIVILEGES;

# 3. Enable auditing to capture GIS activity prior to any crash
mysql> SET GLOBAL general_log = 'ON';
mysql> SET GLOBAL general_log_file = '/var/log/mysql/general.log';