{"id":"CVE-2026-101679","kind":"vulnerability","aliases":["CVE-2026-101679"],"related":[],"title":"MySQL Server and Cluster: unauthenticated network crash causes denial of service","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","summary":"A flaw in the MySQL client programs component of MySQL Server and MySQL Cluster lets an unauthenticated attacker over the network hang or repeatedly crash the server. The impact is availability only, with no data read or code run according to the CVSS vector.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `mysql --version` on the database host to see the installed release.\n- Compare the result against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","fix":"- Move MySQL Server and MySQL Cluster to a release outside the affected ranges, using the patched build from Oracle's advisory (version unknown from the sources).","status":"open","published_at":"2026-10-20T22:18:22+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:19:13+00:00","updated_at":"2026-10-25T03:19:13+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:19:13Z","model":"claude-haiku-5-5","output":{"fix":"- Move MySQL Server and MySQL Cluster to a release outside the affected ranges, using the patched build from Oracle's advisory (version unknown from the sources).","reach":"network","title":"MySQL Server and Cluster: unauthenticated network crash causes denial of service","impact":"low","summary":"A flaw in the MySQL client programs component of MySQL Server and MySQL Cluster lets an unauthenticated attacker over the network hang or repeatedly crash the server. The impact is availability only, with no data read or code run according to the CVSS vector.","category":"runtime","nicknames":[],"who_cares":["mysql","self-hosted","database"],"confidence":0.6,"needs_auth":"no","worst_case":"Database server hangs or crashes repeatedly, causing complete denial of service","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched version numbers and whether the flaw is reachable only through specific client protocols, since the sources give no fix version.","how_to_check":"- Run `mysql --version` on the database host to see the installed release.\n- Compare the result against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams that run MySQL Server or MySQL Cluster in the affected version ranges and expose the listening protocols to a network that attackers can reach. Systems where the database is only reachable on a locked-down internal network carry less risk. Deployments on releases outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":3578,"output_tokens":653,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101679':14A,17A '-2026':13A,16A '/av':161C '26.7.0':94C,105C '26.7.1':95C,106C '3.1':151C,160C '7.5':154C '8.0.0':98C '8.0.49':99C '8.4.0':90C,100C '8.4.12':91C,101C '9.7.0':92C,102C '9.7.3':93C,103C 'abil':134C 'access':115C 'accord':63B 'affect':86C 'allow':110C 'attack':41B,112C,126C 'avail':54B,155C 'base':152C 'caus':8A,136C 'client':29B,80C 'cluster':4A,37B,74C,97C,124C,149C 'code':61B 'complet':143C 'compon':31B,79C 'compromis':120C 'crash':7A,48B,142C 'cve':12A,15A 'cvss':66B,150C,157C,159C 'data':58B 'databas':18B 'denial':9A 'dos':144C 'easili':107C 'exploit':108C 'flaw':25B 'frequent':140C 'h':169C 'hang':45B,138C 'host':23B 'impact':52B,156C 'l/pr':163C 'let':38B 'multipl':117C 'mysql':1A,19B,28B,33B,36B,71C,73C,78C,88C,96C,121C,123C,146C,148C 'n/a':168C 'n/ac':162C 'n/i':167C 'n/s':165C 'n/ui':164C 'network':6A,44B,114C 'oracl':77C 'product':75C 'program':30B,81C 'protocol':118C 'read':59B 'repeat':47B,141C 'result':131C 'run':62B 'runtim':20B 'score':153C 'self':22B 'self-host':21B 'server':2A,34B,50B,72C,89C,122C,147C 'servic':11A 'success':125C 'support':82C 'u/c':166C 'unauthent':5A,40B,111C 'unauthor':133C 'vector':67B,158C 'version':83C 'via':116C 'vulner':68C,109C,129C","nicknames":[],"mitigations":[],"who_affected":"Teams that run MySQL Server or MySQL Cluster in the affected version ranges and expose the listening protocols to a network that attackers can reach. Systems where the database is only reachable on a locked-down internal network carry less risk. Deployments on releases outside the listed ranges are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","severity":null,"published_at":"2026-10-20T22:18:22+00:00","modified_at":"2026-10-22T19:17:34+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}