CVE-2026-61144: 
MySQL vulnerability analysis and mitigation

CVE-2026-61144 is a Denial of Service vulnerability in the Server: Optimizer component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server and MySQL Cluster versions 9.7.0 and 9.7.1. The vulnerability was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPUJul2026). It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), residing in the MySQL Server Optimizer component. A high-privileged attacker with network access can exploit this flaw via multiple protocols to cause the MySQL Server or MySQL Cluster to hang or crash repeatedly. No user interaction is required, and the attack complexity is low, though exploitation requires high-level privileges (e.g., a database administrator account). No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation results in a complete Denial of Service (DoS) of the affected MySQL Server or MySQL Cluster instance, causing it to hang or crash in a frequently repeatable manner. The impact is limited to availability — there is no confidentiality or integrity impact. Affected database services would become unavailable to legitimate users, potentially disrupting dependent applications and business operations (Oracle Advisory).

There is no evidence of public proof-of-concept exploit code or in-the-wild exploitation at this time. The NVD SSVC assessment classifies exploitation as "none" and the technical impact as "partial." The EPSS score is approximately 0.0042 (0.42%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement for high privileges significantly limits the real-world attack surface (Oracle Advisory).

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update (CPUJul2026). Administrators should upgrade affected MySQL Server and MySQL Cluster instances from versions 9.7.0–9.7.1 to a patched release. As a temporary workaround, Oracle recommends restricting network access to MySQL services to only authorized high-privileged users, and monitoring database logs for unusual optimizer-related query patterns. Oracle strongly advises against relying on network-blocking workarounds as a long-term solution (Oracle Advisory).