CVE-2026-46863: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling)

Synopsis

A denial-of-service vulnerability exists in the Connection Handling component of Oracle MySQL Server and MySQL Cluster. The flaw is reachable over any network without authentication, meaning any host that can open a connection to the database port can trigger it. Successful exploitation causes MySQL Server or MySQL Cluster to hang or crash repeatedly, taking the database fully offline. No fix versions have been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the MySQL service over the network; the vulnerability is exposed via multiple protocols on any network-accessible MySQL port.

• AuthenticationNot required

  No credentials are needed; the attacker can trigger the flaw as an unauthenticated client before any login handshake completes.

• Victim interactionNot required

  No user or administrator action is required; the attacker initiates the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup to succeed.

Blast Radius

• Crashes or hangs the MySQL Server or MySQL Cluster process, taking the database completely offline.
• Any application or service dependent on the affected MySQL instance loses database connectivity for the duration of the outage.
• The crash is frequently repeatable, meaning an attacker can sustain the denial of service by re-triggering it after each recovery attempt.