CVE-2026-21941: 
MySQL vulnerability analysis and mitigation

CVE-2026-21941 is a Denial of Service vulnerability in the MySQL Server Optimizer component, affecting Oracle MySQL Server versions 8.0.0–8.0.44, 8.4.0–8.4.7, and 9.0.0–9.5.0. The vulnerability was disclosed on January 20, 2026, as part of Oracle's Critical Patch Update (CPU) for January 2026. It carries a CVSS v3.1 base score of 4.9 (Medium), reflecting its availability-only impact and the requirement for high privileges to exploit (Oracle CPU Jan 2026). IBM API Connect is also listed as an affected product due to its inclusion of vulnerable MySQL Server components (IBM Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), rooted in improper handling of certain query constructs within the MySQL Server Optimizer component. A high-privileged attacker with network access can send specially crafted SQL queries over multiple protocols (e.g., MySQL protocol, TCP/IP) that trigger uncontrolled resource consumption, causing the server to hang or crash repeatedly. No user interaction is required, and attack complexity is low, but exploitation is gated by the requirement for high-privilege credentials (e.g., a DBA-level account). No public technical write-ups or proof-of-concept code have been identified (Oracle CPU Jan 2026).

Successful exploitation results in a complete Denial of Service (DoS) of the MySQL Server — the server may hang or crash in a frequently repeatable manner, disrupting all database-dependent applications and services. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. In environments where MySQL serves as a backend for critical applications, repeated crashes could cause significant service outages and potential data consistency issues if transactions are interrupted (Oracle CPU Jan 2026).

Oracle has released patches for all affected versions as part of the January 2026 Critical Patch Update; administrators should upgrade MySQL Server to versions beyond 8.0.44, 8.4.7, or 9.5.0 respectively. IBM has also released a patch for affected API Connect deployments (advisory published April 14, 2026). As a temporary workaround, Oracle recommends restricting network access to MySQL Server to only trusted, high-privileged users and implementing network-level access controls to reduce exposure. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle CPU Jan 2026, IBM Advisory).

The vulnerability received routine coverage from Linux distribution security channels, with Red Hat, AlmaLinux, Rocky Linux, and Oracle Linux all issuing errata advisories addressing CVE-2026-21941 as part of broader MySQL update packages. Tenable published multiple Nessus detection plugins for the vulnerability. No notable independent researcher commentary or significant social media discussion has been identified, consistent with the vulnerability's medium severity and limited exploitability (Red Hat Errata, AlmaLinux Errata).