{"id":"CVE-2026-101678","kind":"vulnerability","aliases":["CVE-2026-101678"],"related":[],"title":"MySQL Connector/J: unauthenticated network attacker can partially deny service","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).","summary":"MySQL Connector/J, Oracle's Java JDBC driver for MySQL, has a flaw that an unauthenticated network attacker can trigger to cause a partial denial of service. The attack needs a person other than the attacker to interact with the connection, and it affects availability only, with no data exposure reported.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connector-j","java","jdbc","mysql","package"],"not_affected_if":["version-other-than-26.7.0"],"how_to_check":"- Check the Connector/J version in the application's dependencies, for example `mvn dependency:tree | grep mysql-connector` or the `mysql-connector-j` entry in the build file\n- unknown for other checks; the sources do not list a detection command","fix":"- Move Connector/J to a release newer than `26.7.0`; the sources do not name the exact fixed version\n- unknown for other actions; the sources do not describe a configuration workaround","status":"open","published_at":"2026-10-20T22:18:22+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:39:11+00:00","updated_at":"2026-10-25T04:39:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:39:11Z","model":"claude-haiku-5-5","output":{"fix":"- Move Connector/J to a release newer than `26.7.0`; the sources do not name the exact fixed version\n- unknown for other actions; the sources do not describe a configuration workaround","reach":"network","title":"MySQL Connector/J: unauthenticated network attacker can partially deny service","impact":"low","summary":"MySQL Connector/J, Oracle's Java JDBC driver for MySQL, has a flaw that an unauthenticated network attacker can trigger to cause a partial denial of service. The attack needs a person other than the attacker to interact with the connection, and it affects availability only, with no data exposure reported.","category":"package","nicknames":[],"who_cares":["java","mysql","jdbc","connector-j"],"confidence":0.6,"needs_auth":"no","worst_case":"Partial denial of service of applications using the MySQL connector","analyst_note":"Confirm the fixed Connector/J version and the exact affected-version range from the Oracle MySQL security advisory, since the NVD entry names only 26.7.0.","how_to_check":"- Check the Connector/J version in the application's dependencies, for example `mvn dependency:tree | grep mysql-connector` or the `mysql-connector-j` entry in the build file\n- unknown for other checks; the sources do not list a detection command","needs_analyst":true,"not_affected_if":["version-other-than-26.7.0"],"who_is_affected":"Teams whose Java applications use Oracle MySQL Connector/J at version `26.7.0` are in scope, and the sources name no other affected versions. The advisory describes a network attack that needs a user to act, so services that only connect to databases on a closed internal network with no untrusted input reaching the driver are lower risk. The sources do not say which data paths or configurations make a deployment exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":3466,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101678':12A,15A '-2026':11A,14A '/av':153C '26.7.0':91C '3.1':143C,152C '4.3':146C 'abil':129C 'access':100C 'affect':65B,89C 'allow':95C 'attack':5A,39B,50B,57B,97C,109C,119C,121C 'avail':66B,147C 'base':144C 'caus':43B,131C 'compon':82C 'compromis':105C 'connect':62B 'connector':17B,77C,107C,141C 'connector-j':16B 'connector/j':2A,24B,83C 'cve':10A,13A 'cvss':142C,149C,151C 'data':70B 'deni':8A 'denial':46B,134C 'dos':138C 'driver':29B 'easili':92C 'exploit':93C 'exposur':71B 'flaw':34B 'human':111C 'impact':148C 'interact':59B,112C 'j':18B 'java':19B,27B 'jdbc':20B,28B 'l':161C 'l/pr':155C 'multipl':102C 'mysql':1A,21B,23B,31B,76C,81C,106C,140C 'n/a':160C 'n/ac':154C 'n/i':159C 'n/ui':156C 'need':51B 'network':4A,38B,99C 'oracl':25B,80C 'packag':22B 'partial':7A,45B,133C,137C 'person':53B,115C 'product':78C 'protocol':103C 'r/s':157C 'report':72B 'requir':110C 'result':126C 'score':145C 'servic':9A,48B,136C 'success':108C,120C 'support':85C 'trigger':41B 'u/c':158C 'unauthent':3A,37B,96C 'unauthor':128C 'vector':150C 'version':86C 'via':101C 'vulner':73C,94C,124C","nicknames":[],"mitigations":[],"who_affected":"Teams whose Java applications use Oracle MySQL Connector/J at version `26.7.0` are in scope, and the sources name no other affected versions. The advisory describes a network attack that needs a user to act, so services that only connect to databases on a closed internal network with no untrusted input reaching the driver are lower risk. The sources do not say which data paths or configurations make a deployment exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","severity":null,"published_at":"2026-10-20T22:18:22+00:00","modified_at":"2026-10-21T21:17:35+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}