{"id":"CVE-2026-101756","kind":"vulnerability","aliases":["CVE-2026-101756"],"related":[],"title":"MySQL Server GIS flaw lets a privileged user crash the database","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","summary":"A flaw in the GIS component of MySQL Server and MySQL Cluster lets a highly privileged user cause a hang or repeatable crash of the server. The sources describe only denial of service, with no data read or code run.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admins","mysql","mysql-cluster","package","self-hosted"],"not_affected_if":["auth-required","other-versions"],"how_to_check":"- Run `SELECT VERSION();` on the MySQL server and compare against the affected ranges: 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1.\n- Check whether MySQL Cluster is in use on the affected versions.","fix":"- Upgrade MySQL Server and MySQL Cluster to a release after the affected ranges (9.7.3 and 26.7.1 are the last affected builds; the fixed version is unknown from the sources).","status":"open","published_at":"2026-10-20T22:18:30+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:31:18+00:00","updated_at":"2026-10-25T04:31:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:31:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Server and MySQL Cluster to a release after the affected ranges (9.7.3 and 26.7.1 are the last affected builds; the fixed version is unknown from the sources).","reach":"network","title":"MySQL Server GIS flaw lets a privileged user crash the database","impact":"low","summary":"A flaw in the GIS component of MySQL Server and MySQL Cluster lets a highly privileged user cause a hang or repeatable crash of the server. The sources describe only denial of service, with no data read or code run.","category":"package","nicknames":[],"who_cares":["mysql","mysql-cluster","self-hosted","database-admins"],"confidence":0.8,"needs_auth":"yes","worst_case":"Database server hangs or crashes repeatedly, causing denial of service","analyst_note":"","how_to_check":"- Run `SELECT VERSION();` on the MySQL server and compare against the affected ranges: 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1.\n- Check whether MySQL Cluster is in use on the affected versions.","needs_analyst":false,"not_affected_if":["auth-required","other-versions"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster 9.7.0 to 9.7.3 or 26.7.0 to 26.7.1. The attacker needs high privileges on the database, so the risk is mainly to shared or multi-tenant database accounts. Teams on other MySQL versions are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000636,"input_tokens":3542,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101756':14A,17A '-2026':13A,16A '/av':157C '26.7.0':93C,100C '26.7.1':94C,101C '3.1':147C,156C '4.9':150C '9.7.0':91C,97C '9.7.3':92C,98C 'abil':130C 'access':111C 'admin':20B 'affect':87C 'allow':105C 'attack':108C,122C 'avail':151C 'base':148C 'caus':46B,132C 'cluster':24B,40B,75C,96C,120C,145C 'code':67B 'complet':139C 'compon':34B,80C 'compromis':116C 'crash':9A,51B,138C 'cve':12A,15A 'cvss':146C,153C,155C 'data':64B 'databas':11A,19B 'database-admin':18B 'denial':59B 'describ':57B 'dos':140C 'easili':102C 'exploit':103C 'flaw':4A,30B 'frequent':136C 'gis':3A,33B,82C 'h':165C 'h/ui':160C 'hang':48B,134C 'high':43B,106C 'host':28B 'impact':152C 'l/pr':159C 'let':5A,41B 'multipl':113C 'mysql':1A,21B,23B,36B,39B,72C,74C,79C,89C,95C,117C,119C,142C,144C 'mysql-clust':22B 'n/a':164C 'n/ac':158C 'n/i':163C 'n/s':161C 'network':110C 'oracl':78C 'packag':25B 'privileg':7A,44B,107C 'product':76C 'protocol':114C 'read':65B 'repeat':50B,137C 'result':127C 'run':68B 'score':149C 'self':27B 'self-host':26B 'server':2A,37B,54B,73C,81C,90C,118C,143C 'servic':61B 'sourc':56B 'success':121C 'support':83C 'u/c':162C 'unauthor':129C 'user':8A,45B 'vector':154C 'version':84C 'via':112C 'vulner':69C,104C,125C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster 9.7.0 to 9.7.3 or 26.7.0 to 26.7.1. The attacker needs high privileges on the database, so the risk is mainly to shared or multi-tenant database accounts. Teams on other MySQL versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101756","severity":null,"published_at":"2026-10-20T22:18:30+00:00","modified_at":"2026-10-22T18:17:20+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}