---
id: "CVE-2026-101761"
kind: "vulnerability"
aliases: ["CVE-2026-101761"]
title: "MySQL Server: unauthenticated network attacker can crash the database"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "network-restricted", "version-outside-range"]
published_at: "2026-10-20T22:18:31+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T04:08:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101761", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Server: unauthenticated network attacker can crash the database

A flaw in the MySQL Server Encryption component lets an unauthenticated attacker over the network hang or repeatedly crash MySQL Server and MySQL Cluster. The sources describe only a denial of service, with no code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SELECT VERSION();` in MySQL and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1
- Check whether the server accepts connections from untrusted networks, since the sources say the attack needs network access via multiple protocols

## Fix

- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges listed by Oracle; the sources do not name the fixed version numbers
- Restrict network access to the MySQL port until patched

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101761

## From the sources

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_