CVE-2026-21929: 
MySQL vulnerability analysis and mitigation

CVE-2026-21929 is a Denial of Service vulnerability in the MySQL Server Parser component affecting Oracle MySQL Server versions 9.0.0 through 9.5.0. It was disclosed on January 20, 2026, as part of Oracle's Critical Patch Update (CPU) for January 2026. The vulnerability allows a low-privileged authenticated attacker with network access to cause a hang or frequently repeatable crash of the MySQL Server. It carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle CPU Jan 2026).

The vulnerability resides in the Server: Parser component of MySQL Server, meaning specially crafted SQL queries can trigger a fault in the parsing logic, leading to a server hang or crash (CWE classification consistent with improper input handling). The attack vector is network-based, requiring low privileges and no user interaction, but exploitation is rated as high complexity (AC:H), meaning specific conditions or query constructs must be met to reliably trigger the issue. No detailed technical write-ups or public proof-of-concept code have been identified at this time (Oracle CPU Jan 2026).

Successful exploitation results in a complete Denial of Service — either a hang or a frequently repeatable crash of the MySQL Server — affecting availability with no impact to confidentiality or integrity. The scope is limited to the affected MySQL Server instance itself, with no lateral movement potential directly attributable to this vulnerability. Database-dependent applications and services would experience outages for the duration of the disruption (Oracle CPU Jan 2026).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. High attack complexity further reduces the practical exploitability of this flaw (Oracle CPU Jan 2026).

Oracle released a patch for this vulnerability on January 20, 2026, as part of the January 2026 Critical Patch Update. Administrators should upgrade affected MySQL Server instances (versions 9.0.0–9.5.0) to a patched release as soon as possible. As a temporary measure, Oracle recommends restricting network access to MySQL Server to trusted sources only and limiting low-privileged user access. Oracle strongly advises against relying on network-blocking workarounds as a long-term solution (Oracle CPU Jan 2026).