CVE-2026-35235: 
MySQL vulnerability analysis and mitigation

CVE-2026-35235 is a denial-of-service vulnerability in the GIS (Geographic Information System) component of Oracle MySQL Server. It affects supported versions 9.0.0 through 9.6.0 and allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash of the MySQL Server. The vulnerability was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory, Github Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the MySQL Server GIS component does not properly restrict access to or handling of certain inputs, enabling a privileged attacker to trigger a server hang or crash (Github Advisory). The attack vector is network-based, requires no user interaction, and has low attack complexity, but does require high privileges (e.g., a database administrator account). The vulnerability is exploitable via multiple protocols supported by MySQL Server. No public proof-of-concept or detailed technical write-up has been identified at this time (Oracle Advisory).

Successful exploitation results in a complete denial of service — specifically, an unauthorized ability to cause a hang or frequently repeatable crash of the MySQL Server. There is no impact on confidentiality or data integrity; the sole consequence is availability loss. Because the attack requires high privileges, the blast radius is limited to environments where a malicious or compromised privileged database account exists, but the impact on database availability can be severe for dependent applications (Oracle Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.037–0.043%, placing it in a low-risk percentile for near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection support is available via Qualys (detection ID 20573) and Nessus (plugin ID 310826).

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update (released April 21, 2026). Administrators should upgrade MySQL Server to a version beyond 9.6.0 that includes the patch (Oracle Advisory). As interim mitigations, restrict network access to the MySQL Server and limit high-privilege database accounts to only trusted administrators. Monitor MySQL Server logs for unexpected crashes or hang conditions. Oracle strongly recommends applying Critical Patch Update patches as soon as possible rather than relying on network-blocking workarounds as a long-term solution.