CVE-2026-35240: 
MySQL vulnerability analysis and mitigation

CVE-2026-35240 is a denial-of-service vulnerability in the MySQL Server Optimizer component of Oracle MySQL. It affects MySQL Server versions 8.0.0–8.0.45, 8.4.0–8.4.8, and 9.0.0–9.6.0. The vulnerability was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.9 (Medium), reflecting an availability-only impact requiring high privileges (Oracle Advisory, GitHub Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the MySQL Server's Optimizer component, which is responsible for query execution planning (GitHub Advisory). A high-privileged attacker with network access can send crafted queries over multiple protocols (e.g., MySQL protocol, X Protocol) that trigger a hang or repeatedly crash the MySQL Server process. No user interaction is required, and the attack complexity is low, making it straightforward to execute once the attacker has the necessary database credentials. The vulnerability was reported to Oracle by researcher "yx" (Oracle Advisory).

Successful exploitation results in a complete denial of service — the MySQL Server either hangs indefinitely or crashes in a frequently repeatable manner, rendering the database entirely unavailable. There is no impact on confidentiality or data integrity; the sole consequence is loss of availability of the database service. Organizations relying on MySQL for critical applications could experience significant service disruption if a high-privileged account is compromised or misused (Oracle Advisory, GitHub Advisory).

Oracle has released patches for all affected versions as part of the April 2026 Critical Patch Update; administrators should upgrade MySQL Server to versions beyond 8.0.45, 8.4.8, and 9.6.0 respectively (Oracle Advisory). As interim mitigations, restrict network access to the MySQL Server to trusted hosts only, and apply the principle of least privilege by limiting which accounts have high-privilege query execution capabilities. Oracle strongly recommends applying the Critical Patch Update patches without delay rather than relying on network-level workarounds as a long-term solution.