CVE-2026-21949: 
MySQL vulnerability analysis and mitigation

CVE-2026-21949 is a Denial of Service vulnerability in the MySQL Server Optimizer component, affecting MySQL Server versions 9.0.0 through 9.5.0. It was disclosed on January 20, 2026, as part of Oracle's Critical Patch Update (CPU) for January 2026. The vulnerability allows a low-privileged attacker with network access to cause the MySQL Server to hang or repeatedly crash, resulting in complete service unavailability. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle CPU Jan 2026).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), rooted in the MySQL Server's query Optimizer component failing to properly limit resource usage when processing specially crafted queries. An attacker with low privileges and network access can send malicious queries via multiple protocols (e.g., MySQL protocol, X Protocol) that trigger excessive resource consumption, causing the server to hang or crash. No user interaction is required, and attack complexity is low, making it straightforward to exploit with valid credentials. The vulnerability was reported by Jingzhou Fu and Zhiyong Wu of WingTecher Lab at Tsinghua University (Oracle CPU Jan 2026).

Successful exploitation results in a complete Denial of Service (DoS) of the MySQL Server — the server may hang indefinitely or crash repeatedly, making the database entirely unavailable to legitimate users and applications. There is no impact on confidentiality or integrity; the sole impact is on availability. Any application or service dependent on the affected MySQL Server instance would experience outages, potentially causing cascading failures in multi-tier architectures (Oracle CPU Jan 2026).

1. Reconnaissance: Identify MySQL Server instances running versions 9.0.0–9.5.0 exposed on the network using port scanning tools (e.g., Nmap targeting port 3306 or 33060 for X Protocol).
2. Credential Acquisition: Obtain low-privileged MySQL credentials through phishing, credential stuffing, or reuse of compromised accounts — no administrative privileges are required.
3. Connect to MySQL Server: Establish a connection to the target MySQL Server using a standard MySQL client or scripting library (e.g., mysql -u lowprivuser -p -h target).
4. Craft Malicious Query: Construct a specially crafted SQL query targeting the Optimizer component that triggers uncontrolled resource consumption (specific query patterns are not publicly disclosed).
5. Execute DoS: Submit the crafted query repeatedly or in a loop to cause the server to hang or crash, resulting in complete service unavailability for all connected users and applications (Oracle CPU Jan 2026).

• Network: Repeated connection attempts or sustained sessions from a low-privileged account to MySQL ports (3306, 33060) with unusually long query execution times.
• Logs: MySQL error log (mysqld.err) showing repeated crashes, Got signal 11 or similar fatal error entries, or Query execution was interrupted messages correlated with specific user sessions.
• Process: MySQL server process (mysqld) consuming abnormally high CPU or memory, or the process terminating and restarting repeatedly (visible via system monitoring or systemctl status mysql).
• Application: Downstream applications reporting database connection timeouts or failures coinciding with the suspicious query activity.

Oracle has released patches for this vulnerability as part of the January 2026 Critical Patch Update; users should upgrade MySQL Server to a version beyond 9.5.0 that includes the fix. As interim mitigations, restrict network access to MySQL Server ports (3306, 33060) to only authorized hosts and applications using firewall rules. Additionally, implement query timeouts (max_execution_time) and resource limits for low-privileged accounts, and monitor for repeated server crashes or hangs with automated alerting. Oracle strongly recommends applying the CPU patches without delay rather than relying on workarounds (Oracle CPU Jan 2026).

Red Hat has acknowledged the vulnerability and published a CVE tracking page for affected downstream products (Red Hat CVE). Tenable has released a Nessus detection plugin (ID 296582) and Qualys has added detection (ID 20530), enabling automated scanning for affected systems. No significant public researcher commentary or social media discussion has been observed beyond standard vulnerability tracking and scanner updates.