CVE-2026-35238: 
MySQL vulnerability analysis and mitigation

CVE-2026-35238 is a Denial of Service vulnerability in the InnoDB component of Oracle MySQL Server. It affects versions 8.0.0–8.0.45, 8.4.0–8.4.8, and 9.0.0–9.6.0. The vulnerability was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory, Github Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the InnoDB storage engine component of MySQL Server (Github Advisory). A high-privileged attacker with network access can exploit this flaw via multiple protocols (e.g., MySQL protocol over TCP) to trigger a hang or frequently repeatable crash of the MySQL Server process. Exploitation requires valid high-privilege credentials (such as a DBA-level account) but does not require user interaction or complex attack conditions. No public proof-of-concept code or detailed technical write-up has been identified at this time (Feedly).

Successful exploitation results in a complete Denial of Service (DoS) of the MySQL Server — either a persistent hang or a frequently repeatable crash — affecting availability of all databases hosted on the instance. There is no impact on confidentiality or data integrity, as the vulnerability is limited to availability. Downstream applications and services dependent on the affected MySQL instance would also experience outages during exploitation (Oracle Advisory).

Oracle has released patches for all affected version branches as part of the April 2026 Critical Patch Update; administrators should upgrade MySQL Server to versions beyond 8.0.45, 8.4.8, and 9.6.0 respectively (Oracle Advisory). Red Hat has also issued errata (RHSA-2026:20693, RHSA-2026:23332, RHSA-2026:25052) for affected MySQL packages in RHEL environments (Feedly). As a temporary workaround, restrict network access to the MySQL Server port to only authorized high-privilege accounts, and implement network-level access controls to limit exposure. Oracle strongly recommends applying the Critical Patch Update patches without delay rather than relying on network-level mitigations alone.