CVE-2026-61109: MySQL Server/Cluster DoS Vulnerability

CVE-2026-61109 Overview

CVE-2026-61109 is a denial of service vulnerability affecting the JSON component of Oracle MySQL Server and MySQL Cluster. A low-privileged attacker with network access can exploit this flaw over multiple protocols to cause a hang or repeatable crash. Successful exploitation results in complete availability loss for the targeted database service.

The vulnerability affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can trigger a complete denial of service against MySQL Server and MySQL Cluster instances, disrupting dependent applications and services.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47
Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-61109 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61109

Vulnerability Analysis

The flaw resides in the JSON component of MySQL Server and MySQL Cluster. The JSON subsystem processes JSON documents and expressions through functions such as JSON_EXTRACT, JSON_TABLE, and related operators. Improper handling of specifically crafted JSON input causes the server to hang or crash, terminating query processing for all clients.

This is classified as a Denial of Service (DoS) vulnerability with availability impact only. Confidentiality and integrity are not affected. The Oracle advisory notes the attack is easily exploitable and can be reproduced reliably.

Root Cause

The root cause lies in the JSON parsing or evaluation logic within the MySQL Server process. Malformed or malicious JSON payloads passed to affected functions trigger an unrecoverable condition. This causes the mysqld process to hang indefinitely or crash, resulting in a complete service outage.

Attack Vector

Exploitation requires network access to the MySQL service and low-privilege authenticated credentials. No user interaction is required. The attacker submits a crafted SQL statement referencing JSON functions or JSON-typed columns through any supported client protocol. Once processed, the query causes the server to hang or terminate. Because MySQL Cluster nodes replicate state, disruption can propagate across the cluster.

See the Oracle Critical Patch Update Advisory for further technical context.

Detection Methods for CVE-2026-61109

Indicators of Compromise

Unexpected mysqld process crashes or restarts recorded in the MySQL error log
Sudden spikes in JSON function calls (JSON_EXTRACT, JSON_TABLE, JSON_SEARCH) from low-privilege accounts
Repeated connection failures or client timeouts against affected MySQL Server or Cluster nodes
Signal termination entries (SIGSEGV, SIGABRT) in operating system logs for the mysqld service

Detection Strategies

Enable MySQL general query and error logs, then alert on repeated crash signatures involving JSON expressions
Baseline normal JSON function usage per application account and flag statistically anomalous query patterns
Correlate database process restarts with preceding SQL statements captured via audit plugins

Monitoring Recommendations

Monitor mysqld uptime and restart counters through infrastructure monitoring tools
Track authentication events for low-privilege accounts issuing JSON queries against production databases
Forward MySQL audit and error logs to a centralized SIEM for correlation with network telemetry

How to Mitigate CVE-2026-61109

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all MySQL Server and MySQL Cluster instances running affected versions
Inventory all MySQL deployments and identify instances running versions 8.0.0-8.0.47, 8.4.0-8.4.10, or 9.7.0-9.7.1
Restrict network exposure of MySQL services to trusted application tiers only
Review and reduce database account privileges following least-privilege principles

Patch Information

Oracle addressed CVE-2026-61109 in the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server and MySQL Cluster to the fixed releases documented in the Oracle Security Alert July 2026. Test patches in a staging environment before rolling to production clusters.

Workarounds

Place MySQL services behind a firewall or private network segment that blocks untrusted client access
Enforce strict SQL access controls, limiting which accounts can execute JSON functions on production data
Deploy a database proxy or query firewall to inspect and rate-limit suspicious JSON expressions
Increase resource limits and configure automatic service restart to reduce outage duration until patched

bash

# Configuration example: restrict MySQL network exposure via bind-address
# /etc/mysql/mysql.conf.d/mysqld.cnf
[mysqld]
bind-address = 10.0.0.10
skip-networking = OFF

# Restart the MySQL service after applying changes
sudo systemctl restart mysql

# Verify the listening address
ss -tlnp | grep 3306