CVE-2026-46862: Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General)

Synopsis

This is a denial-of-service vulnerability in Oracle MySQL Router, affecting versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0. An unauthenticated attacker with network access can send crafted TLS traffic to trigger a hang or repeated crash of the MySQL Router process, requiring no credentials and no victim interaction. No fix versions have been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the MySQL Router service over the network via TLS; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is reachable by any unauthenticated network client.

• Victim interactionNot required

  The attack is fully one-sided and requires no action from any user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors must be aligned for the attack to succeed.

Blast Radius

• Crashes or hangs the MySQL Router process, cutting off all database connections routed through it.
• Applications that depend on MySQL Router for load balancing or failover lose connectivity for the duration of the outage.
• Repeated, easily triggered crashes can sustain a prolonged denial of service without requiring the attacker to maintain a persistent foothold.