CVE-2026-21948: 
MySQL vulnerability analysis and mitigation

CVE-2026-21948 is a denial-of-service vulnerability in the MySQL Server Optimizer component, affecting MySQL Server versions 8.0.0–8.0.44, 8.4.0–8.4.7, and 9.0.0–9.5.0. It was disclosed on January 20, 2026, as part of Oracle's January 2026 Critical Patch Update. The vulnerability allows a high-privileged attacker with network access to cause the MySQL Server to hang or crash repeatedly, resulting in complete unavailability of the database service. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle CPU Jan 2026). IBM API Connect is also listed as an affected downstream product (IBM Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), residing in the MySQL Server's query Optimizer component. A high-privileged attacker with network access can send specially crafted queries that trigger uncontrolled resource consumption, causing the server to hang or crash. The attack vector is network-based, requires no user interaction, and has low attack complexity, though it does require high privileges (e.g., a valid database account with sufficient permissions). No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU Jan 2026).

Successful exploitation results exclusively in an availability impact — specifically, the ability to cause a complete denial of service by making the MySQL Server hang or crash in a frequently repeatable manner. There is no confidentiality or integrity impact associated with this vulnerability. The scope is limited to the affected MySQL Server instance, with no evidence of lateral movement potential; however, database unavailability can have significant downstream effects on applications and services dependent on the affected MySQL instance (Oracle CPU Jan 2026).

Oracle released patches for this vulnerability on January 20, 2026, as part of the January 2026 Critical Patch Update. Administrators should upgrade MySQL Server to versions beyond 8.0.44, 8.4.7, and 9.5.0 respectively. As interim mitigations, Oracle recommends restricting network access to MySQL Server to only trusted administrative accounts and networks, implementing network segmentation, and limiting which users can execute complex optimizer queries. IBM API Connect users should also apply the relevant patches referenced in IBM's advisory (Oracle CPU Jan 2026, IBM Advisory).

The vulnerability was reported to Oracle by Ryan Brothers, as credited in the January 2026 Critical Patch Update advisory. Downstream Linux distributions including Red Hat, Rocky Linux, AlmaLinux, and Oracle Linux have issued their own security errata addressing this CVE as part of broader MySQL update packages. No significant independent researcher commentary or notable media coverage specific to this vulnerability has been identified (Oracle CPU Jan 2026).