CVE-2026-61109: 
MySQL vulnerability analysis and mitigation

CVE-2026-61109 is a denial-of-service vulnerability in the Server: JSON component of Oracle MySQL Server and MySQL Cluster. It was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPU) for July 2026. Affected versions include MySQL Server 8.4.0–8.4.10 and 9.7.0–9.7.1, and MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle Advisory).

The vulnerability resides in the JSON processing component of MySQL Server and MySQL Cluster, where improper handling of crafted input can cause the server to hang or crash. It is classified as an availability-impacting flaw exploitable by a low-privileged, network-adjacent or remote attacker over multiple protocols without requiring user interaction. The attack complexity is low, meaning no special conditions or race conditions are required beyond valid credentials. The vulnerability was reported by researcher vnth4nhnt (Oracle Advisory). No public technical write-up or proof-of-concept code has been identified at this time.

Successful exploitation results in a complete denial of service — specifically, an unauthorized ability to cause a hang or frequently repeatable crash of the affected MySQL Server or MySQL Cluster instance. There is no impact on confidentiality or integrity; the vulnerability is purely an availability issue. Because the crash is described as "frequently repeatable," an attacker with low-level database credentials could sustain a persistent outage against the targeted database service (Oracle Advisory).

1. Reconnaissance: Identify MySQL Server or MySQL Cluster instances running affected versions (MySQL Server 8.4.0–8.4.10 or 9.7.0–9.7.1; MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, or 9.7.0–9.7.1) using network scanning tools such as Nmap with MySQL service detection.
2. Obtain low-privileged credentials: Acquire any valid MySQL user account — this could be through credential stuffing, phishing, or use of a default/weak account, as only low privileges are required.
3. Connect to the target: Establish a connection to the MySQL instance over any supported protocol (e.g., TCP/IP on port 3306).
4. Trigger the JSON component flaw: Submit a specially crafted SQL query involving JSON functions or operations that triggers the vulnerable code path in the Server: JSON component, causing the server to hang or crash.
5. Repeat for sustained DoS: Because the crash is described as "frequently repeatable," re-issue the malicious query after each server restart to maintain a persistent denial-of-service condition (Oracle Advisory).

• Logs: MySQL error log (mysqld.err or mysql_error.log) showing repeated crash or hang events, particularly involving JSON-related operations or functions.
• Process: Unexpected termination or restart of the mysqld process; monitoring tools (e.g., systemd, process supervisors) logging frequent MySQL service restarts.
• Network: Repeated connections from the same low-privileged account issuing JSON-heavy queries immediately before each crash event; unusual query patterns in the MySQL general query log targeting JSON functions.
• Application: Application-layer errors indicating loss of database connectivity in a repeating pattern correlated with specific client activity.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server to a version beyond 8.4.10 or 9.7.1, and MySQL Cluster to a version beyond 8.0.47, 8.4.10, or 9.7.1, as applicable. As a temporary workaround, Oracle recommends restricting network access to MySQL services and limiting the privileges of database accounts to reduce exposure, though neither approach is a long-term substitute for patching (Oracle Advisory).