{"id":"CVE-2026-101761","kind":"vulnerability","aliases":["CVE-2026-101761"],"related":[],"title":"MySQL Server: unauthenticated network attacker can crash the database","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","summary":"A flaw in the MySQL Server Encryption component lets an unauthenticated attacker over the network hang or repeatedly crash MySQL Server and MySQL Cluster. The sources describe only a denial of service, with no code execution or data access.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["managed-hosting","network-restricted","version-outside-range"],"how_to_check":"- Run `SELECT VERSION();` in MySQL and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1\n- Check whether the server accepts connections from untrusted networks, since the sources say the attack needs network access via multiple protocols","fix":"- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges listed by Oracle; the sources do not name the fixed version numbers\n- Restrict network access to the MySQL port until patched","status":"open","published_at":"2026-10-20T22:18:31+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:08:30+00:00","updated_at":"2026-10-25T04:08:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:08:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges listed by Oracle; the sources do not name the fixed version numbers\n- Restrict network access to the MySQL port until patched","reach":"network","title":"MySQL Server: unauthenticated network attacker can crash the database","impact":"low","summary":"A flaw in the MySQL Server Encryption component lets an unauthenticated attacker over the network hang or repeatedly crash MySQL Server and MySQL Cluster. The sources describe only a denial of service, with no code execution or data access.","category":"package","nicknames":[],"who_cares":["mysql","database","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Database server hangs or crashes repeatedly, causing denial of service","analyst_note":"Confirm the fixed MySQL versions from the Oracle Critical Patch Update advisory, since the sources list only affected ranges.","how_to_check":"- Run `SELECT VERSION();` in MySQL and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1\n- Check whether the server accepts connections from untrusted networks, since the sources say the attack needs network access via multiple protocols","needs_analyst":true,"not_affected_if":["managed-hosting","version-outside-range","network-restricted"],"who_is_affected":"Deployments running an affected MySQL Server or MySQL Cluster version that accept network connections, including any exposed listener. The sources say exploitation is difficult and needs no authentication, so internal-only or firewalled servers carry less risk. Teams on managed database services handled by the provider can skip the patch step but should confirm with the provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":3592,"output_tokens":712,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101761':12A,15A '-2026':11A,14A '/av':156C '26.7.0':88C,99C '26.7.1':89C,100C '3.1':146C,155C '5.9':149C '8.0.0':92C '8.0.49':93C '8.4.0':84C,94C '8.4.12':85C,95C '9.7.0':86C,96C '9.7.3':87C,97C 'abil':129C 'access':60B,110C 'affect':80C 'allow':105C 'attack':5A,33B,107C,121C 'avail':150C 'base':147C 'caus':131C 'cluster':45B,67C,91C,119C,144C 'code':56B 'complet':138C 'compon':29B,72C 'compromis':115C 'crash':7A,40B,137C 'cve':10A,13A 'cvss':145C,152C,154C 'data':59B 'databas':9A,16B 'denial':51B 'describ':48B 'difficult':101C 'dos':139C 'encrypt':28B,75C 'execut':57B 'exploit':103C 'flaw':23B 'frequent':135C 'h':164C 'h/pr':158C 'hang':37B,133C 'host':21B 'impact':151C 'let':30B 'multipl':112C 'mysql':1A,17B,26B,41B,44B,64C,66C,71C,82C,90C,116C,118C,141C,143C 'n/a':163C 'n/ac':157C 'n/i':162C 'n/s':160C 'n/ui':159C 'network':4A,36B,109C 'oracl':70C 'packag':18B 'product':68C 'protocol':113C 'repeat':39B,136C 'result':126C 'score':148C 'secur':74C 'self':20B 'self-host':19B 'server':2A,27B,42B,65C,73C,83C,117C,142C 'servic':53B 'sourc':47B 'success':120C 'support':76C 'u/c':161C 'unauthent':3A,32B,106C 'unauthor':128C 'vector':153C 'version':77C 'via':111C 'vulner':61C,104C,124C","nicknames":[],"mitigations":[],"who_affected":"Deployments running an affected MySQL Server or MySQL Cluster version that accept network connections, including any exposed listener. The sources say exploitation is difficult and needs no authentication, so internal-only or firewalled servers carry less risk. Teams on managed database services handled by the provider can skip the patch step but should confirm with the provider.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101761","severity":null,"published_at":"2026-10-20T22:18:31+00:00","modified_at":"2026-10-22T18:17:20+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}