{"id":"CVE-2026-101622","kind":"vulnerability","aliases":["CVE-2026-101622"],"related":[],"title":"MySQL Server: InnoDB flaw lets a privileged user crash the database","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","summary":"A flaw in the InnoDB storage engine of MySQL Server and MySQL Cluster can be triggered by a high-privileged user over the network to cause a hang or repeatable crash. The impact is denial of service only; the sources report no confidentiality or integrity loss.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["managed-hosting","version-outside-range"],"how_to_check":"- Run `SELECT @@version;` on the MySQL server and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","fix":"- Move MySQL Server or MySQL Cluster to a release that Oracle lists as fixed for this CVE; the sources do not name the fixed version, so check the Oracle Critical Patch Update advisory.","status":"open","published_at":"2026-10-20T22:18:16+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:31:34+00:00","updated_at":"2026-10-25T04:31:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:31:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move MySQL Server or MySQL Cluster to a release that Oracle lists as fixed for this CVE; the sources do not name the fixed version, so check the Oracle Critical Patch Update advisory.","reach":"network","title":"MySQL Server: InnoDB flaw lets a privileged user crash the database","impact":"low","summary":"A flaw in the InnoDB storage engine of MySQL Server and MySQL Cluster can be triggered by a high-privileged user over the network to cause a hang or repeatable crash. The impact is denial of service only; the sources report no confidentiality or integrity loss.","category":"package","nicknames":[],"who_cares":["mysql","database","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Database server hangs or crashes repeatedly, causing full denial of service.","analyst_note":"Find the fixed MySQL versions for CVE-2026-101622 in Oracle's Critical Patch Update advisory, since the sources list only affected ranges.","how_to_check":"- Run `SELECT @@version;` on the MySQL server and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","needs_analyst":true,"not_affected_if":["version-outside-range","managed-hosting"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges. The attacker needs high privileges on the database, so exposure is mainly to accounts that already hold broad rights; teams on other versions or other database engines can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":3579,"output_tokens":658,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101622':14A,17A '-2026':13A,16A '/av':164C '26.7.0':96C,107C '26.7.1':97C,108C '3.1':154C,163C '4.9':157C '8.0.0':100C '8.0.49':101C '8.4.0':92C,102C '8.4.12':93C,103C '9.7.0':94C,104C '9.7.3':95C,105C 'abil':137C 'access':118C 'affect':88C 'allow':112C 'attack':115C,129C 'avail':158C 'base':155C 'caus':50B,139C 'cluster':36B,77C,99C,127C,152C 'complet':146C 'compon':82C 'compromis':123C 'confidenti':67B 'crash':9A,55B,145C 'cve':12A,15A 'cvss':153C,160C,162C 'databas':11A,18B 'denial':59B 'dos':147C 'easili':109C 'engin':30B 'exploit':110C 'flaw':4A,25B 'frequent':143C 'h':172C 'h/ui':167C 'hang':52B,141C 'high':43B,113C 'high-privileg':42B 'host':23B 'impact':57B,159C 'innodb':3A,28B,83C 'integr':69B 'l/pr':166C 'let':5A 'loss':70B 'multipl':120C 'mysql':1A,19B,32B,35B,74C,76C,81C,90C,98C,124C,126C,149C,151C 'n/a':171C 'n/ac':165C 'n/i':170C 'n/s':168C 'network':48B,117C 'oracl':80C 'packag':20B 'privileg':7A,44B,114C 'product':78C 'protocol':121C 'repeat':54B,144C 'report':65B 'result':134C 'score':156C 'self':22B 'self-host':21B 'server':2A,33B,75C,91C,125C,150C 'servic':61B 'sourc':64B 'storag':29B 'success':128C 'support':84C 'trigger':39B 'u/c':169C 'unauthor':136C 'user':8A,45B 'vector':161C 'version':85C 'via':119C 'vulner':71C,111C,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges. The attacker needs high privileges on the database, so exposure is mainly to accounts that already hold broad rights; teams on other versions or other database engines can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101622","severity":null,"published_at":"2026-10-20T22:18:16+00:00","modified_at":"2026-10-21T19:16:50+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}