CVE-2026-61128: 
MySQL vulnerability analysis and mitigation

CVE-2026-61128 is a Denial of Service vulnerability in the Optimizer component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server and MySQL Cluster versions 9.7.0 and 9.7.1. The vulnerability was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPU) for July 2026. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), residing in the MySQL Server Optimizer component. A high-privileged attacker with network access can exploit this flaw via multiple protocols without requiring user interaction, triggering uncontrolled resource consumption that causes the database service to hang or crash repeatedly. The attack complexity is low, meaning no special conditions or race conditions are required beyond having high-privileged network access to the MySQL instance (Oracle Advisory).

Successful exploitation results in a complete Denial of Service (DoS) of the affected MySQL Server or MySQL Cluster instance, causing it to hang or crash in a frequently repeatable manner. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Organizations relying on affected MySQL 9.7.x deployments for critical database services could experience sustained database outages if exploited (Oracle Advisory).

There is no public proof-of-concept exploit code known at this time, and no evidence of active in-the-wild exploitation has been observed. The EPSS score is approximately 0.31%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high-privileged credentials, which significantly limits the attacker pool (Oracle Advisory).

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server and MySQL Cluster from affected versions 9.7.0–9.7.1 to the patched release provided in the CPU. As a temporary workaround, Oracle recommends restricting network access to the MySQL service to only authorized high-privileged users and administrative systems, and implementing network segmentation to limit which hosts can communicate with the database server. Oracle strongly advises applying the security patch as soon as possible rather than relying on workarounds (Oracle Advisory).