CVE-2026-61109: 
MySQL vulnerability analysis and mitigation

CVE-2026-61109 is a Denial of Service vulnerability in the JSON component of Oracle MySQL Server and MySQL Cluster. It was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPU) for July 2026. Affected versions include MySQL Server 8.4.0–8.4.10 and 9.7.0–9.7.1, and MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle CPU Jul 2026).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the MySQL Server or Cluster fails to properly limit resource usage when processing certain JSON-related inputs. A low-privileged attacker with network access can send crafted requests via multiple supported protocols to trigger uncontrolled resource consumption, causing the server to hang or crash repeatedly. No user interaction is required, and attack complexity is low, making the vulnerability straightforward to exploit given valid credentials. The vulnerability was reported to Oracle by vnth4nhnt of CyStack (Oracle CPU Jul 2026).

Successful exploitation results in a complete Denial of Service (DoS) of the affected MySQL Server or MySQL Cluster instance — the server may hang indefinitely or crash in a frequently repeatable manner. There is no impact on confidentiality or integrity; the sole impact is on availability. In environments where MySQL is a critical backend service, repeated exploitation could cause sustained service outages affecting dependent applications and users (Oracle CPU Jul 2026).

There is no public proof-of-concept exploit or evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.39%, indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and automation as "no" (Oracle CPU Jul 2026).

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server to a version beyond 8.4.10 or 9.7.1, and MySQL Cluster to a version beyond 8.0.47, 8.4.10, or 9.7.1, as applicable. As a temporary workaround, restricting network access to MySQL instances to only authorized users and systems can reduce exposure. Oracle strongly recommends applying the CPU patches as soon as possible rather than relying on network-level controls as a long-term solution (Oracle CPU Jul 2026).