{"id":"CVE-2026-101810","kind":"vulnerability","aliases":["CVE-2026-101810"],"related":[],"title":"MySQL Router: unauthenticated network attacker can hang or crash the router","description":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","summary":"MySQL Router 26.7.0 has a flaw in its general request handling that lets an unauthenticated attacker over the network make the router hang or repeatedly crash. The impact is denial of service only; the sources report no code execution or data exposure.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","mysql-router","package","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"- Run `mysqlrouter --version` and check whether it reports `26.7.0`\n- unknown","fix":"- Upgrade MySQL Router past `26.7.0`; the sources do not name the fixed version\n- unknown","status":"open","published_at":"2026-10-20T22:18:37+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:19:02+00:00","updated_at":"2026-10-25T03:19:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:19:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Router past `26.7.0`; the sources do not name the fixed version\n- unknown","reach":"network","title":"MySQL Router: unauthenticated network attacker can hang or crash the router","impact":"low","summary":"MySQL Router 26.7.0 has a flaw in its general request handling that lets an unauthenticated attacker over the network make the router hang or repeatedly crash. The impact is denial of service only; the sources report no code execution or data exposure.","category":"package","nicknames":[],"who_cares":["mysql","mysql-router","database","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Router becomes unavailable through repeated crashes or hangs","analyst_note":"Confirm the fixed MySQL Router version and the exact protocols affected in Oracle's security alert for CVE-2026-101810 at https://nvd.nist.gov/vuln/detail/CVE-2026-101810.","how_to_check":"- Run `mysqlrouter --version` and check whether it reports `26.7.0`\n- unknown","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Deployments running MySQL Router 26.7.0 that accept network connections from clients. The sources do not describe a non-default configuration that is required. Routers on other versions are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000598,"input_tokens":3440,"output_tokens":508,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101810':14A,17A '-2026':13A,16A '/av':139C '26.7.0':29B,88C '3.1':129C,138C '7.5':132C 'abil':114C 'access':97C 'affect':86C 'allow':92C 'attack':5A,42B,94C,106C 'avail':133C 'base':130C 'caus':116C 'code':64B 'complet':123C 'compon':78C 'compromis':102C 'crash':9A,52B,122C 'cve':12A,15A 'cvss':128C,135C,137C 'data':67B 'databas':18B 'denial':56B 'dos':124C 'easili':89C 'execut':65B 'exploit':90C 'exposur':68B 'flaw':32B 'frequent':120C 'general':35B,80C 'h':147C 'handl':37B 'hang':7A,49B,118C 'host':26B 'impact':54B,134C 'l/pr':141C 'let':39B 'make':46B 'multipl':99C 'mysql':1A,19B,21B,27B,72C,77C,103C,126C 'mysql-rout':20B 'n/a':146C 'n/ac':140C 'n/i':145C 'n/s':143C 'n/ui':142C 'network':4A,45B,96C 'oracl':76C 'packag':23B 'product':74C 'protocol':100C 'repeat':51B,121C 'report':62B 'request':36B 'result':111C 'router':2A,11A,22B,28B,48B,73C,79C,104C,127C 'score':131C 'self':25B 'self-host':24B 'servic':58B 'sourc':61B 'success':105C 'support':82C 'u/c':144C 'unauthent':3A,41B,93C 'unauthor':113C 'vector':136C 'version':83C 'via':98C 'vulner':69C,91C,109C","nicknames":[],"mitigations":[],"who_affected":"Deployments running MySQL Router 26.7.0 that accept network connections from clients. The sources do not describe a non-default configuration that is required. Routers on other versions are not listed as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101810","severity":null,"published_at":"2026-10-20T22:18:37+00:00","modified_at":"2026-10-22T19:17:35+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}