Skip to content
Fencer Vulns
medium 4.9

CVE-2026-21998 json

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

published 2026-04-21 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-24295

cvss
4.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Patch / fix

  • mysql-8.0 Ubuntu 22.04 LTS 8.0.46-0ubuntu0.22.04.2
  • mysql-8.0 Ubuntu 24.04 LTS 8.0.46-0ubuntu0.24.04.2
  • mysql-8.4 Ubuntu 25.10 8.4.9-0ubuntu0.25.10.1
  • mysql-8.4 Ubuntu 26.04 LTS 8.4.9-0ubuntu0.26.04.1
  • mysql-8.0 Ubuntu Pro 20.04 LTS 8.0.46-0ubuntu0.20.04.1+esm2

ubuntu advisories UBUNTU-CVE-2026-21998

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • mecab RHEL 8 0.996-2.module+el8.10.0+23550+bd321b9a
  • mysql RHEL 8 8.4.9-1.module+el8.10.0+24336+5a933ab6
  • mysql-libs RHEL 8 8.4.9-1.module+el8.10.0+24336+5a933ab6
  • mysql-test RHEL 8 8.4.9-1.module+el8.10.0+24336+5a933ab6
  • mecab-ipadic RHEL 8 2.7.0.20070801-17.module+el8.10.0+23550+bd321b9a
  • mysql-common RHEL 8 8.4.9-1.module+el8.10.0+24336+5a933ab6
  • mysql-errmsg RHEL 8 8.4.9-1.module+el8.10.0+24336+5a933ab6
  • mysql-server RHEL 8 8.4.9-1.module+el8.10.0+24336+5a933ab6

red hat advisories RHSA-2026:26180RHSA-2026:25919RHSA-2026:25052RHSA-2026:23332RHSA-2026:20693

  • mecab AlmaLinux 8 0.996-2.module_el8.10.0+4060+d4256e26
  • mysql AlmaLinux 8 8.4.9-1.module_el8.10.0+4193+cbb8e728
  • mysql-libs AlmaLinux 8 8.4.9-1.module_el8.10.0+4193+cbb8e728
  • mysql-test AlmaLinux 8 8.4.9-1.module_el8.10.0+4193+cbb8e728
  • mecab-ipadic AlmaLinux 8 2.7.0.20070801-17.module_el8.10.0+4060+d4256e26
  • mecab-ipadic AlmaLinux 8 2.7.0.20070801-17.module_el8.10.0+4154+a69a9128
  • mysql-common AlmaLinux 8 8.4.9-1.module_el8.10.0+4193+cbb8e728
  • mysql-errmsg AlmaLinux 8 8.4.9-1.module_el8.10.0+4193+cbb8e728

almalinux advisories ALSA-2026:26180ALSA-2026:25919ALSA-2026:25052ALSA-2026:23332ALSA-2026:20693

  • mecab Rocky Linux 8 0.996-2.module+el8.10.0+1676+9b4b6e24
  • mecab Rocky Linux 8 0.996-2.module+el8.10.0+1937+28fbbc83
  • mecab Rocky Linux 8 0.996-2.module+el8.10.0+2091+db4d14f6
  • mecab-ipadic Rocky Linux 8 2.7.0.20070801-17.module+el8.10.0+1937+28fbbc83
  • mecab-ipadic Rocky Linux 8 2.7.0.20070801-17.module+el8.10.0+2091+db4d14f6
  • mysql Rocky Linux 9 8.0.46-1.el9_8.rocky.0.1
  • mecab Rocky Linux 9 0.996-3.module+el9.8.0+40162+a76274f1.4
  • rapidjson Rocky Linux 9 1.1.0-19.module+el9.8.0+40162+a76274f1

rocky linux advisories RLSA-2026:26180RLSA-2026:25919RLSA-2026:23332RLSA-2026:25052RLSA-2026:20693

  • mysql Azure Linux 3.0 8.0.46-1

azure linux advisories AZL-83121

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-21998 updated cvss 4.9

mysql: Optimizer unspecified vulnerability (CPU Apr 2026)

  • Red Hat Enterprise Linux AppStream (v. 8) mecab 0.996-2.module+el8.10.0+22857+7f331edd, mecab 0.996-2.module+el8.10.0+23550+bd321b9a, mysql 8.4.9-1.module+el8.10.0+24336+5a933ab6, mysql 8.0.46-1.module+el8.10.0+24370+d5a391f0, mysql-libs 8.4.9-1.module+el8.10.0+24336+5a933ab6, mysql-test 8.4.9-1.module+el8.10.0+24336+5a933ab6, +13 more
    fixed: vendor fix RHSA-2026:25919
  • Red Hat Enterprise Linux AppStream (v. 9) mysql 8.0.46-1.el9_8, mysql-libs 8.0.46-1.el9_8, mysql-common 8.0.46-1.el9_8, mysql-errmsg 8.0.46-1.el9_8, mysql-server 8.0.46-1.el9_8, mysql 8.4.9-1.module+el9.8.0+24348+9b27f387, +11 more
    fixed: vendor fix RHSA-2026:25052
  • Red Hat Enterprise Linux AppStream (v. 10) mysql8.4 8.4.9-1.el10_2, mysql8.4-libs 8.4.9-1.el10_2, mysql8.4-common 8.4.9-1.el10_2, mysql8.4-errmsg 8.4.9-1.el10_2, mysql8.4-server 8.4.9-1.el10_2
    fixed: vendor fix RHSA-2026:20693
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) mysql-test 8.0.46-1.el9_8
    fixed: vendor fix RHSA-2026:23332
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) mysql8.4-test 8.4.9-1.el10_2, mysql8.4-test-data 8.4.9-1.el10_2
    fixed: vendor fix RHSA-2026:20693
  • Red Hat Enterprise Linux 6 mysql, mysql-libs, mysql-test, mysql-bench, mysql-server, mysql-embedded
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Oracle Corporation MySQL Server

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.