{"id":"CVE-2026-101778","kind":"vulnerability","aliases":["CVE-2026-101778"],"related":[],"title":"MySQL Server: low-privilege network user can crash the server","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","summary":"A low-privileged user with network access can trigger a hang or repeatable crash in the MySQL Server Components Services component, per Oracle's advisory as summarised by NVD. The attacker gets denial of service only; the sources report no confidentiality or integrity impact.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `SELECT VERSION();` on the server and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","fix":"- Upgrade MySQL Server or MySQL Cluster to a release after the affected ranges listed above; the sources do not name the fixed version numbers.\n- Check Oracle's Critical Patch Update advisory for the exact patched build, which the sources do not give.","status":"open","published_at":"2026-10-20T22:18:33+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:53:44+00:00","updated_at":"2026-10-25T03:53:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:53:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Server or MySQL Cluster to a release after the affected ranges listed above; the sources do not name the fixed version numbers.\n- Check Oracle's Critical Patch Update advisory for the exact patched build, which the sources do not give.","reach":"network","title":"MySQL Server: low-privilege network user can crash the server","impact":"low","summary":"A low-privileged user with network access can trigger a hang or repeatable crash in the MySQL Server Components Services component, per Oracle's advisory as summarised by NVD. The attacker gets denial of service only; the sources report no confidentiality or integrity impact.","category":"package","nicknames":[],"who_cares":["mysql","self-hosted","database"],"confidence":0.7,"needs_auth":"yes","worst_case":"Database server hangs or crashes repeatedly, causing full denial of service","analyst_note":"Check Oracle's CPU advisory for the fixed build numbers and whether any non-default configuration is required; NVD text alone does not give them.","how_to_check":"- Run `SELECT VERSION();` on the server and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges that accept network connections from users with low privileges. Systems on versions outside these ranges, or with no network-reachable MySQL port, face less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":3583,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101778':14A,17A '-2026':13A,16A '/av':164C '26.7.0':96C,107C '26.7.1':97C,108C '3.1':154C,163C '6.5':157C '8.0.0':100C '8.0.49':101C '8.4.0':92C,102C '8.4.12':93C,103C '9.7.0':94C,104C '9.7.3':95C,105C 'abil':137C 'access':31B,118C 'advisori':49B 'affect':88C 'allow':112C 'attack':55B,115C,129C 'avail':158C 'base':155C 'caus':139C 'cluster':75C,99C,127C,152C 'complet':146C 'compon':43B,45B,80C,82C 'compromis':123C 'confidenti':65B 'crash':9A,38B,145C 'cve':12A,15A 'cvss':153C,160C,162C 'databas':18B 'denial':57B 'dos':147C 'easili':109C 'exploit':110C 'frequent':143C 'get':56B 'h':172C 'hang':35B,141C 'host':23B 'impact':68B,159C 'integr':67B 'l/pr':166C 'l/ui':167C 'low':4A,26B,113C 'low-privileg':3A,25B 'multipl':120C 'mysql':1A,19B,41B,72C,74C,79C,90C,98C,124C,126C,149C,151C 'n/a':171C 'n/ac':165C 'n/i':170C 'n/s':168C 'network':6A,30B,117C 'nvd':53B 'oracl':47B,78C 'packag':20B 'per':46B 'privileg':5A,27B,114C 'product':76C 'protocol':121C 'repeat':37B,144C 'report':63B 'result':134C 'score':156C 'self':22B 'self-host':21B 'server':2A,11A,42B,73C,81C,91C,125C,150C 'servic':44B,59B,83C 'sourc':62B 'success':128C 'summaris':51B 'support':84C 'trigger':33B 'u/c':169C 'unauthor':136C 'user':7A,28B 'vector':161C 'version':85C 'via':119C 'vulner':69C,111C,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges that accept network connections from users with low privileges. Systems on versions outside these ranges, or with no network-reachable MySQL port, face less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101778","severity":null,"published_at":"2026-10-20T22:18:33+00:00","modified_at":"2026-10-22T18:17:22+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}