CVE-2026-61144: MySQL Server Optimizer DoS Vulnerability

CVE-2026-61144 Overview

CVE-2026-61144 affects the Optimizer component of Oracle MySQL Server and MySQL Cluster. The flaw allows a high-privileged attacker with network access, using multiple protocols, to trigger a hang or repeatable crash resulting in a complete denial of service. Affected releases include MySQL Server versions 9.7.0 through 9.7.1 and MySQL Cluster versions 9.7.0 through 9.7.1. Oracle published the issue in the Oracle Security Alert July 2026. The vulnerability impacts availability only, with no confidentiality or integrity effects. The EPSS score is 0.422% at the 34.508 percentile as of 2026-07-23.

Critical Impact
Authenticated attackers can crash or hang MySQL Server and MySQL Cluster instances, causing complete service outage for dependent applications.

Affected Products

Oracle MySQL Server versions 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 9.7.0 through 9.7.1
Deployments exposing the MySQL Optimizer to authenticated network sessions

Discovery Timeline

2026-07-21 - CVE-2026-61144 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle published fix in the Critical Patch Update advisory

Technical Details for CVE-2026-61144

Vulnerability Analysis

The defect resides in the MySQL Optimizer, the subsystem responsible for parsing and planning SQL query execution. A high-privileged authenticated user can submit a crafted request that forces the Optimizer into a state producing a hang or repeatable crash. The condition affects both standalone MySQL Server and MySQL Cluster deployments. Because the attack vector is network-based and reachable through multiple MySQL protocols, any client session with sufficient privileges can trigger the fault. Oracle classifies the exploitability as easy, meaning no elaborate preconditions or timing windows are required. The outcome is a complete denial of service, halting query processing for all connected applications.

Root Cause

Oracle has not disclosed the internal defect path. The advisory identifies the Optimizer component as the affected code area. Based on the impact profile, the flaw likely stems from improper handling of a query construct that the planner cannot process safely, producing an unrecoverable exception or infinite processing loop. No CWE identifier has been assigned in the published advisory.

Attack Vector

An attacker must already hold high database privileges before exploitation. The attacker connects over the network using a supported MySQL protocol and issues the malformed query or command sequence. The server process enters a hang or crashes, terminating all in-flight sessions. Because MySQL Cluster nodes share the Optimizer implementation, a single crafted request can propagate the outage across the cluster topology.

No verified public exploit code is available. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-61144

Indicators of Compromise

Unexpected mysqld process termination or restart events in system logs
Repeated client disconnect errors correlated with a single authenticated user session
MySQL error log entries referencing Optimizer faults, assertion failures, or signal handler output
Sudden loss of quorum or node failure events across MySQL Cluster data nodes

Detection Strategies

Monitor MySQL error logs for crash signatures, stack traces, and abnormal shutdown messages
Correlate database availability alerts with the authenticated account and source IP that submitted the last query
Enable the MySQL general query log or audit plugin to capture the SQL statements preceding a crash
Compare query patterns across MySQL nodes to identify repeated malformed statements from the same principal

Monitoring Recommendations

Alert on repeated mysqld restarts within short intervals through process supervisors such as systemd
Track failed connection spikes following Optimizer errors to identify cascading impact
Forward MySQL audit and error logs to a centralized analytics platform for correlation
Baseline typical query execution times and flag statements that consistently precede service failure

How to Mitigate CVE-2026-61144

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all MySQL Server 9.7.0–9.7.1 and MySQL Cluster 9.7.0–9.7.1 instances
Review and reduce database accounts holding high privileges such as SUPER, PROCESS, or administrative roles
Restrict network reachability of MySQL listeners to trusted application subnets
Enable the MySQL audit plugin to record privileged session activity

Patch Information

Oracle addressed the vulnerability in the July 2026 Critical Patch Update. Administrators should upgrade to the fixed release identified in the Oracle Security Alert July 2026. MySQL Cluster deployments require patching every data, management, and SQL node to eliminate exposure.

Workarounds

Revoke administrative privileges from application service accounts that do not require them
Enforce network segmentation and firewall rules limiting MySQL protocol access to known hosts
Require strong authentication and rotate credentials for privileged database accounts
Configure automatic service recovery to reduce downtime while patching is scheduled

bash

# Restrict privileged access and verify MySQL version
mysql -u root -p -e "SELECT VERSION();"
mysql -u root -p -e "SHOW GRANTS FOR 'app_user'@'%';"
mysql -u root -p -e "REVOKE SUPER, PROCESS ON *.* FROM 'app_user'@'%';"
mysql -u root -p -e "FLUSH PRIVILEGES;"