CVE-2026-21998: 
MySQL vulnerability analysis and mitigation

CVE-2026-21998 is a Denial of Service vulnerability in the MySQL Server Optimizer component of Oracle MySQL. It affects MySQL Server versions 8.0.0–8.0.45, 8.4.0–8.4.8, and 9.0.0–9.6.0. The vulnerability was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory, GitHub Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the MySQL Server Optimizer component fails to properly control resource allocation when processing certain inputs, which can lead to a server hang or crash (GitHub Advisory). An attacker with high privileges (e.g., a DBA-level account) and network access can exploit this flaw over multiple protocols without requiring user interaction. The low attack complexity means that once the attacker has the necessary credentials, exploitation is straightforward and repeatable. No public proof-of-concept code or detailed technical write-up has been identified at this time (Oracle Advisory).

Successful exploitation results in a complete Denial of Service (DoS) of the MySQL Server — specifically, the ability to cause the server to hang or crash in a frequently repeatable manner. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability. Any application or service dependent on the affected MySQL Server instance would experience an outage for the duration of the attack (Oracle Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.037–0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (network-accessible, authenticated attacker), which limits the attack surface compared to unauthenticated vulnerabilities.

Oracle has released patches for all affected versions as part of the April 2026 Critical Patch Update. Administrators should upgrade MySQL Server to versions beyond 8.0.45, 8.4.8, and 9.6.0 respectively, or apply the specific patches provided in the Oracle CPU documentation (Oracle Advisory). As a temporary workaround, restrict network access to the MySQL Server to trusted, high-privileged administrators only, and implement network segmentation to limit exposure. Oracle strongly recommends applying the patch rather than relying on network-level controls as a long-term solution.

Oracle addressed this vulnerability as part of its April 2026 Critical Patch Update, which contained 481 new security patches across its product families. No notable independent researcher commentary or significant social media discussion specific to CVE-2026-21998 has been identified, consistent with its medium severity rating and the requirement for high privileges to exploit (Oracle Advisory).