CVE-2026-22005: 
MySQL vulnerability analysis and mitigation

CVE-2026-22005 is a Denial of Service vulnerability in the MySQL Server Optimizer component of Oracle MySQL. It affects MySQL Server versions 8.0.0–8.0.45, 8.4.0–8.4.8, and 9.0.0–9.6.0. The vulnerability was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory, GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the MySQL Server Optimizer component fails to properly control resource allocation when processing certain inputs, leading to server hangs or crashes (GitHub Advisory). The vulnerability is network-accessible via multiple protocols and requires no user interaction, but does require high privileges (e.g., a DBA-level account) to exploit. The attack complexity is low, meaning no special conditions or race conditions are needed beyond authenticated access. CVE-2026-22005 was reported to Oracle by HoraceYang of Tencent Security YUNDING LAB, Xiaodong Qi of Shui Mu Yu Lin, and Yuanyi Li of Shui Mu Yu Lin (Oracle Advisory). No public proof-of-concept or detailed technical write-up has been identified at this time.

Successful exploitation results in a complete Denial of Service (DoS) of the MySQL Server — specifically, the ability to cause the server to hang or crash in a frequently repeatable manner, disrupting all database-dependent services and applications (Oracle Advisory). There is no impact on confidentiality or integrity; the vulnerability is purely an availability issue. Because the attacker must already hold high privileges, the blast radius is limited to environments where privileged database accounts may be compromised or misused.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.037–0.047%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement for high privileges significantly limits the attacker pool, reducing practical exploitability despite the low attack complexity.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Administrators should upgrade MySQL Server to versions beyond 8.0.45, 8.4.8, and 9.6.0 respectively, as directed by Oracle's patch guidance (Oracle Advisory). As interim mitigations, Oracle recommends restricting network access to MySQL Server to trusted hosts only and enforcing strict role-based access controls to limit high-privilege accounts to authorized users. Red Hat has also issued corresponding errata (RHSA-2026:20693, RHSA-2026:23332, RHSA-2026:25052) for affected Linux distributions (GitHub Advisory).

Oracle acknowledged the vulnerability reporters — HoraceYang of Tencent Security YUNDING LAB, Xiaodong Qi, and Yuanyi Li of Shui Mu Yu Lin — in its April 2026 Critical Patch Update advisory (Oracle Advisory). No notable independent researcher commentary, social media discussion, or significant media coverage specific to this CVE has been identified, consistent with its moderate severity rating and limited exploitability.