Skip to content
Fencer Vulns
medium 4.9

CVE-2026-34278 json

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).

published 2026-04-21 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-24354

cvss
4.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Patch / fix

  • mysql-8.0 Ubuntu 22.04 LTS 8.0.46-0ubuntu0.22.04.2
  • mysql-8.0 Ubuntu 24.04 LTS 8.0.46-0ubuntu0.24.04.2
  • mysql-8.0 Ubuntu Pro 20.04 LTS 8.0.46-0ubuntu0.20.04.1+esm2

ubuntu advisories UBUNTU-CVE-2026-34278

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • mecab RHEL 8 0.996-2.module+el8.10.0+22857+7f331edd
  • mysql RHEL 8 8.0.46-1.module+el8.10.0+24370+d5a391f0
  • mysql-libs RHEL 8 8.0.46-1.module+el8.10.0+24370+d5a391f0
  • mysql-test RHEL 8 8.0.46-1.module+el8.10.0+24370+d5a391f0
  • mecab-ipadic RHEL 8 2.7.0.20070801-17.module+el8.10.0+22857+7f331edd
  • mysql-common RHEL 8 8.0.46-1.module+el8.10.0+24370+d5a391f0
  • mysql-errmsg RHEL 8 8.0.46-1.module+el8.10.0+24370+d5a391f0
  • mysql-server RHEL 8 8.0.46-1.module+el8.10.0+24370+d5a391f0

red hat advisories RHSA-2026:25919RHSA-2026:23332

  • mecab AlmaLinux 8 0.996-2.module_el8.10.0+3965+b415b607
  • mecab AlmaLinux 8 0.996-2.module_el8.6.0+3340+d764b636
  • mysql AlmaLinux 8 8.0.46-1.module_el8.10.0+4192+724bc664
  • mysql-libs AlmaLinux 8 8.0.46-1.module_el8.10.0+4192+724bc664
  • mysql-test AlmaLinux 8 8.0.46-1.module_el8.10.0+4192+724bc664
  • mecab-ipadic AlmaLinux 8 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
  • mecab-ipadic AlmaLinux 8 2.7.0.20070801-17.module_el8.10.0+4142+0b28b031
  • mysql-common AlmaLinux 8 8.0.46-1.module_el8.10.0+4192+724bc664

almalinux advisories ALSA-2026:25919ALSA-2026:23332

  • mecab Rocky Linux 8 0.996-2.module+el8.10.0+2091+db4d14f6
  • mecab Rocky Linux 8 0.996-2.module+el8.10.0+1676+9b4b6e24
  • mecab Rocky Linux 8 0.996-2.module+el8.10.0+1937+28fbbc83
  • mecab-ipadic Rocky Linux 8 2.7.0.20070801-17.module+el8.10.0+1937+28fbbc83
  • mecab-ipadic Rocky Linux 8 2.7.0.20070801-17.module+el8.10.0+2091+db4d14f6
  • mysql Rocky Linux 9 8.0.46-1.el9_8.rocky.0.1

rocky linux advisories RLSA-2026:25919RLSA-2026:23332

  • mysql Azure Linux 3.0 8.0.46-1

azure linux advisories AZL-83115

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34278 updated cvss 4.9

mysql: Optimizer unspecified vulnerability (CPU Apr 2026)

  • Red Hat Enterprise Linux 8 mecab, mysql, mysql-libs, mysql-test, mecab-ipadic, mysql-common, +4 more Red Hat Enterprise Linux 9 mysql, mysql-libs, mysql-test, mysql-common, mysql-errmsg, mysql-server Red Hat Enterprise Linux 10 mysql8.4
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) mecab 0.996-2.module+el8.10.0+22857+7f331edd, mysql 8.0.46-1.module+el8.10.0+24370+d5a391f0, mysql-libs 8.0.46-1.module+el8.10.0+24370+d5a391f0, mysql-test 8.0.46-1.module+el8.10.0+24370+d5a391f0, mysql-common 8.0.46-1.module+el8.10.0+24370+d5a391f0, mysql-errmsg 8.0.46-1.module+el8.10.0+24370+d5a391f0, +3 more
    fixed: vendor fix RHSA-2026:25919
  • Red Hat Enterprise Linux AppStream (v. 9) mysql 8.0.46-1.el9_8, mysql-libs 8.0.46-1.el9_8, mysql-common 8.0.46-1.el9_8, mysql-errmsg 8.0.46-1.el9_8, mysql-server 8.0.46-1.el9_8 Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) mysql-test 8.0.46-1.el9_8
    fixed: vendor fix RHSA-2026:23332
  • Red Hat Enterprise Linux 6 mysql, mysql-libs, mysql-test, mysql-bench, mysql-server, mysql-embedded
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Oracle Corporation MySQL Server

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.