CVE-2026-61128: MySQL Server Optimizer DOS Vulnerability

CVE-2026-61128 Overview

CVE-2026-61128 is a denial of service vulnerability in the Oracle MySQL Server and MySQL Cluster products. The flaw resides in the Server: Optimizer component and affects MySQL Server versions 9.7.0 through 9.7.1 and MySQL Cluster versions 9.7.0 through 9.7.1. An authenticated attacker with high privileges can exploit the vulnerability over the network using multiple protocols. Successful exploitation causes a hang or repeatable crash, producing a complete denial of service on the affected database instance. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated remote attackers can cause complete denial of service against MySQL Server and MySQL Cluster instances by triggering optimizer hangs or crashes.

Affected Products

Oracle MySQL Server versions 9.7.0 to 9.7.1
Oracle MySQL Cluster versions 9.7.0 to 9.7.1
MySQL Server: Optimizer component

Discovery Timeline

2026-07-21 - CVE CVE-2026-61128 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Disclosed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61128

Vulnerability Analysis

The vulnerability affects the query optimizer subsystem of MySQL Server and MySQL Cluster. The optimizer analyzes SQL statements and selects execution plans. A malformed or crafted query causes the optimizer to enter a state that either hangs the server thread or triggers a repeatable crash. Because the fault reaches core query processing logic, the impact is availability-only, with no confidentiality or integrity loss.

Exploitation requires an authenticated session with high privileges on the database instance. The attacker submits queries through supported MySQL protocols after authenticating. Once triggered, the crash or hang propagates across worker threads and takes the database service offline until restart.

Oracle categorizes this issue under its July 2026 Critical Patch Update. The Oracle advisory groups MySQL fixes for Server and Cluster editions in the same release cycle.

Root Cause

The root cause is an unhandled condition within the MySQL optimizer when processing specific query structures. The optimizer fails to bound or validate an internal state, producing either an infinite loop (hang) or an abort condition (crash). Oracle has not published a component-level technical writeup for this specific CVE.

Attack Vector

The attack is network-based and requires authentication with high privileges. The attacker connects to the MySQL Server or Cluster instance over any supported protocol, then executes a crafted SQL statement that reaches the vulnerable optimizer path. No user interaction is required. Because privilege requirements are high, the primary risk arises from compromised administrative accounts, malicious insiders, or shared database environments where privileged access is broadly granted.

No public proof-of-concept exploit is available. The EPSS probability is 0.31% at the 23.2 percentile as of 2026-07-23.

No verified code examples are available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-61128

Indicators of Compromise

Unexpected MySQL server crashes or restarts logged in mysqld.err or the systemd journal shortly after query execution.
MySQL threads stuck in Sending data or optimizing states with no progress, followed by connection saturation.
Repeated abnormal disconnects from a single privileged account issuing complex queries.

Detection Strategies

Audit MySQL general query log and slow query log for repeated crash-adjacent statements from privileged users.
Correlate mysqld process termination events with the last executed statements from performance_schema.events_statements_history.
Compare running MySQL Server and Cluster versions against 9.7.0 and 9.7.1 using SELECT VERSION(); and flag vulnerable builds.

Monitoring Recommendations

Alert on MySQL service restarts and worker thread hangs through infrastructure monitoring.
Track privileged account query patterns and volume, especially outside baseline hours.
Forward MySQL error logs to a centralized SIEM to identify crash clusters and correlate with account activity.

How to Mitigate CVE-2026-61128

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all MySQL Server and MySQL Cluster deployments running versions 9.7.0 or 9.7.1.
Review and reduce accounts holding high database privileges such as SUPER, PROCESS, or global ALL PRIVILEGES.
Restrict network access to MySQL listener ports so only application hosts and administrative jump boxes can reach the service.

Patch Information

Oracle addressed CVE-2026-61128 in the July 2026 Critical Patch Update. Administrators should follow the fixed-version guidance in the Oracle Security Alert July 2026 and upgrade MySQL Server and MySQL Cluster to the patched release identified in that advisory.

Workarounds

Revoke privileged database access from users and services that do not require it, reducing the pool of accounts capable of triggering the flaw.
Enforce network segmentation and firewall rules so MySQL instances are not reachable from untrusted networks.
Enable query auditing and rate limiting on privileged accounts through MySQL Enterprise Audit or equivalent plugins.

bash

# Verify MySQL version and identify vulnerable instances
mysql -u root -p -e "SELECT VERSION();"

# Review accounts with high privileges
mysql -u root -p -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y' OR Process_priv='Y';"

# Restrict network exposure by binding to internal interface only
# Edit /etc/mysql/my.cnf
# [mysqld]
# bind-address = 10.0.0.10
systemctl restart mysql