---
id: "CVE-2026-101810"
kind: "vulnerability"
aliases: ["CVE-2026-101810"]
title: "MySQL Router: unauthenticated network attacker can hang or crash the router"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "mysql-router", "package", "self-hosted"]
not_affected_if: ["other-versions"]
published_at: "2026-10-20T22:18:37+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:19:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101810", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Router: unauthenticated network attacker can hang or crash the router

MySQL Router 26.7.0 has a flaw in its general request handling that lets an unauthenticated attacker over the network make the router hang or repeatedly crash. The impact is denial of service only; the sources report no code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mysqlrouter --version` and check whether it reports `26.7.0`
- unknown

## Fix

- Upgrade MySQL Router past `26.7.0`; the sources do not name the fixed version
- unknown

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101810

## From the sources

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_