CVE-2026-35234: 
MySQL vulnerability analysis and mitigation

CVE-2026-35234 is a denial-of-service vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Partition component. It was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update, and affects MySQL Server versions 9.0.0 through 9.6.0. The vulnerability has a CVSS v3.1 base score of 4.9 (Medium) (Oracle CPU Apr 2026, Github Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control), indicating that the MySQL Server's partition handling component does not properly restrict access to or processing of certain operations (Github Advisory). An attacker with high privileges and network access via multiple protocols can trigger the flaw to cause the MySQL Server process to hang or crash repeatedly. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once the attacker has the necessary administrative credentials. No public technical write-ups or proof-of-concept code have been identified at this time (Feedly).

Successful exploitation results exclusively in an availability impact — specifically, the ability to cause a complete denial of service by hanging or repeatedly crashing the MySQL Server process. There is no confidentiality or integrity impact, meaning data exposure and data modification are not direct consequences of this vulnerability. The affected scope is limited to the MySQL Server instance itself; however, database unavailability can have significant downstream effects on applications and services dependent on the database (Oracle CPU Apr 2026).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation of CVE-2026-35234 at this time (Feedly). The EPSS score is approximately 0.037–0.043%, placing it in a low percentile for near-term exploitation likelihood (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (e.g., a DBA-level account), which limits the attacker pool but does not eliminate insider threat or compromised credential scenarios.

Oracle has addressed this vulnerability in the April 2026 Critical Patch Update (CPU). Administrators should apply the relevant MySQL patches for affected versions (9.0.0–9.6.0) as soon as possible (Oracle CPU Apr 2026). As a temporary workaround, restrict network access to the MySQL Server to only trusted, high-privileged administrators, and implement network segmentation to limit exposure of the database service. Oracle strongly advises against relying on network-level mitigations as a long-term solution and recommends patching promptly.