CVE-2026-35236: 
MySQL vulnerability analysis and mitigation

CVE-2026-35236 is a denial-of-service vulnerability in the InnoDB component of Oracle MySQL Server. It affects MySQL Server versions 8.0.0–8.0.45, 8.4.0–8.4.8, and 9.0.0–9.6.0. The vulnerability was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory, GitHub Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the InnoDB storage engine component of MySQL Server (GitHub Advisory). An attacker with high privileges and network access can exploit this flaw via multiple protocols to cause the MySQL Server to hang or crash repeatedly. Exploitation requires no user interaction and has low attack complexity, though it does require high-privilege credentials (e.g., a DBA-level account). No specific technical write-up or proof-of-concept code has been publicly disclosed (Oracle Advisory).

Successful exploitation results in a complete denial of service — the MySQL Server can be made to hang or crash in a frequently repeatable manner, disrupting all database-dependent services and applications. The impact is limited to availability; there is no confidentiality or integrity impact, and the scope remains unchanged (the vulnerability does not enable lateral movement or data exfiltration) (Oracle Advisory).

Oracle has addressed this vulnerability in the April 2026 Critical Patch Update. Administrators should upgrade MySQL Server to versions beyond 8.0.45, 8.4.8, and 9.6.0 respectively, as patched releases are available (Oracle Advisory). As a temporary workaround, restrict network access to the MySQL Server to trusted, high-privileged administrators only, and implement network segmentation to limit exposure. Oracle strongly recommends applying the Critical Patch Update patches as soon as possible rather than relying on network-level mitigations long-term. Red Hat has also issued errata (RHSA-2026:20693, RHSA-2026:23332, RHSA-2026:25052) for affected MySQL packages in RHEL environments.