CVE-2026-101801: 
MySQL vulnerability analysis and mitigation

CVE-2026-101801 is a denial-of-service vulnerability in the Optimizer component of Oracle MySQL Server and MySQL Cluster. It was disclosed on October 20, 2026, as part of Oracle's Critical Patch Update (CPU) for October 2026. Affected versions include MySQL Server 8.4.0–8.4.12, 9.7.0–9.7.3, and 26.7.0–26.7.1, as well as MySQL Cluster 8.0.0–8.0.49, 8.4.0–8.4.12, 9.7.0–9.7.3, and 26.7.0–26.7.1. The vulnerability carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory).

The vulnerability resides in the Server: Optimizer component of MySQL Server and MySQL Cluster, where a flaw in query processing logic can be triggered by a specially crafted query. The attack vector is network-based with low attack complexity, but requires high privileges (e.g., a database administrative account) — no user interaction is needed. The root cause is classified as an availability-impacting flaw (CWE category: improper handling of exceptional conditions in the optimizer), allowing a privileged attacker to cause the server to hang or crash repeatedly. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation results in a complete denial of service — the MySQL Server or MySQL Cluster instance can be made to hang or crash in a frequently repeatable manner, rendering the database unavailable. There is no impact on confidentiality or integrity; the sole impact is on availability. Applications and services dependent on the affected database instances would experience outages for the duration of the attack (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (e.g., a privileged database user account with network access), which significantly limits the attacker pool (Oracle Advisory).

Oracle has released patches addressing this vulnerability as part of the October 2026 Critical Patch Update. Users should upgrade MySQL Server to versions beyond 8.4.12, 9.7.3, or 26.7.1, and MySQL Cluster to versions beyond 8.0.49, 8.4.12, 9.7.3, or 26.7.1. As a temporary workaround, restrict network access to the MySQL service to only authorized, trusted users, and enforce the principle of least privilege to limit which accounts can execute complex optimizer-triggering queries. Oracle strongly recommends applying the patch without delay rather than relying on network-level mitigations as a long-term solution (Oracle Advisory).