CVE-2026-34272: 
MySQL vulnerability analysis and mitigation

CVE-2026-34272 is a Denial of Service vulnerability in the MySQL Server Optimizer component of Oracle MySQL, affecting versions 9.0.0 through 9.6.0. Disclosed on April 21, 2026, as part of Oracle's Critical Patch Update (CPU) for April 2026, the flaw allows a low-privileged attacker with network access to cause the MySQL Server to hang or repeatedly crash. It carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle CPU April 2026, Github Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the MySQL Server Optimizer does not properly control the allocation or maintenance of limited resources when processing certain inputs (Github Advisory). An attacker with low-level network privileges can send crafted queries or requests via multiple supported protocols to trigger the optimizer flaw, causing the server to hang or crash. No user interaction is required, and attack complexity is low, making it straightforward to exploit once valid credentials are obtained. No public technical write-ups or proof-of-concept code have been identified at this time.

Successful exploitation results in a complete loss of availability for the MySQL Server — the database service can be made to hang or crash repeatedly, constituting a full Denial of Service (DoS). There is no impact on confidentiality or data integrity, as the vulnerability is limited to availability effects. Organizations relying on affected MySQL Server versions (9.0.0–9.6.0) for critical database services face potential sustained outages if exploited (Oracle CPU April 2026).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.04% (14th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection coverage is available via Qualys scanner (detection ID 20573) and Tenable Nessus (plugin 310807).

Oracle has addressed this vulnerability in the April 2026 Critical Patch Update; users should upgrade MySQL Server to a version beyond 9.6.0 as soon as possible (Oracle CPU April 2026). As a temporary measure, restrict network access to the MySQL Server and enforce the principle of least privilege for database accounts to limit exposure. Oracle does not recommend relying on network-blocking workarounds as a long-term solution, as they do not address the underlying flaw. Monitor for unusual or resource-intensive query patterns that could indicate exploitation attempts against the optimizer component.