CVE-2026-101799: 
MySQL vulnerability analysis and mitigation

CVE-2026-101799 is a denial-of-service vulnerability in the Group Replication GCS (Group Communication System) component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server versions 8.4.0–8.4.12, 9.7.0–9.7.3, and 26.7.0–26.7.1, and MySQL Cluster versions 8.0.0–8.0.49, 8.4.0–8.4.12, 9.7.0–9.7.3, and 26.7.0–26.7.1. The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle Advisory).

The vulnerability resides in the Server: Group Replication GCS component of Oracle MySQL, which handles inter-node communication in Group Replication and MySQL Cluster deployments. An unauthenticated attacker with access to the physical network segment (adjacent network) where the MySQL Server or MySQL Cluster hardware operates can exploit this flaw with low attack complexity and no user interaction required. The root cause is classified as an availability-impacting weakness (no CWE explicitly disclosed by Oracle), and the attack vector is adjacent network (AV:A), meaning the attacker must be on the same physical or logical network segment as the target. The vulnerability was reported to Oracle by Binbin Xu of Tencent YUNDING LAB CodeBuddy Security (Oracle Advisory).

Successful exploitation results in a complete denial of service — specifically, the ability to cause a hang or frequently repeatable crash of the affected MySQL Server or MySQL Cluster instances. There is no impact on confidentiality or integrity; the impact is limited entirely to availability. In environments relying on MySQL Group Replication or MySQL Cluster for high-availability database services, repeated exploitation could cause sustained database outages affecting dependent applications (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires adjacent network access, which limits the attacker pool to those with physical or logical proximity to the MySQL deployment (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the October 2026 Critical Patch Update. Administrators should upgrade MySQL Server to a version beyond 8.4.12, 9.7.3, or 26.7.1, and MySQL Cluster to a version beyond 8.0.49, 8.4.12, 9.7.3, or 26.7.1. As a temporary workaround, restrict network access to the physical communication segment where MySQL instances are deployed to trusted systems only, and implement network segmentation to limit exposure to the Group Replication GCS component. Oracle strongly recommends applying patches as soon as possible rather than relying on network-level mitigations as a long-term solution (Oracle Advisory).