CVE-2026-21950: 
MySQL vulnerability analysis and mitigation

CVE-2026-21950 is a Denial of Service vulnerability in the MySQL Server Optimizer component, affecting versions 9.0.0 through 9.5.0. It was disclosed on January 20, 2026, as part of Oracle's January 2026 Critical Patch Update. A low-privileged, authenticated attacker with network access can exploit this vulnerability to cause a hang or repeatedly crash the MySQL Server. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), indicating that the MySQL Server Optimizer component fails to properly limit resource usage when processing certain queries or inputs. An attacker with low privileges and network access via multiple protocols (e.g., MySQL protocol, TCP) can send crafted requests to the Optimizer component that trigger uncontrolled resource consumption, resulting in a server hang or crash. No authentication bypass is required — the attacker only needs a valid low-privileged database account. The vulnerability was reported by Jingzhou Fu and Zhiyong Wu of WingTecher Lab at Tsinghua University (Oracle Advisory).

Successful exploitation results in a complete Denial of Service (DoS) of the MySQL Server — either a hang or a frequently repeatable crash — affecting availability with no impact on confidentiality or integrity. Because the crash is described as "frequently repeatable," an attacker can sustain the outage, preventing legitimate users and applications from accessing the database. This could cause significant disruption to any application or service dependent on the affected MySQL instance (Oracle Advisory).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. Despite being "easily exploitable" per Oracle's classification (low complexity, low privileges required, no user interaction), the limited scope of affected versions (9.0.0–9.5.0) and the absence of public PoC reduce immediate risk (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the January 2026 Critical Patch Update (CPU), published January 20, 2026. Administrators should upgrade affected MySQL Server instances (versions 9.0.0–9.5.0) to a patched version as soon as possible. As a temporary workaround, Oracle recommends restricting network access to the MySQL Server to block the protocols used in the attack, and limiting low-privileged user accounts that can execute queries against the Optimizer component. Neither workaround is a permanent fix and may impact application functionality (Oracle Advisory).