Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).

published 2026-07-21 3 mo ago modified 2026-07-27 3 mo ago also EUVD-2026-46538

cvss: 4.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Patch / fix

distros 4

ubuntu red hat almalinux rocky linux

mysql-8.0 Ubuntu 22.04 LTS 8.0.46-0ubuntu0.22.04.4
mysql-8.0 Ubuntu 24.04 LTS 8.0.46-0ubuntu0.24.04.4
mysql-8.4 Ubuntu 26.04 LTS 8.4.11-0ubuntu0.26.04.1

ubuntu advisories UBUNTU-CVE-2026-47052

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

mecab RHEL 9 0.996-3.module+el9.8.0+24348+9b27f387.4
mysql RHEL 9 8.4.11-1.module+el9.8.0+24663+27effc5a
rapidjson RHEL 9 1.1.0-19.module+el9.8.0+24348+9b27f387
mysql-libs RHEL 9 8.4.11-1.module+el9.8.0+24663+27effc5a
mysql-test RHEL 9 8.4.11-1.module+el9.8.0+24663+27effc5a
mecab-ipadic RHEL 9 2.7.0.20070801-24.module+el9.8.0+24348+9b27f387
mysql-common RHEL 9 8.4.11-1.module+el9.8.0+24663+27effc5a
mysql-errmsg RHEL 9 8.4.11-1.module+el9.8.0+24663+27effc5a

red hat advisories RHSA-2026:56973 RHSA-2026:56936 RHSA-2026:56007

mecab AlmaLinux 8 0.996-2.module_el8.10.0+4060+d4256e26
mysql AlmaLinux 8 8.4.11-1.module_el8.10.0+4255+e01a855c
mysql-libs AlmaLinux 8 8.4.11-1.module_el8.10.0+4255+e01a855c
mysql-test AlmaLinux 8 8.4.11-1.module_el8.10.0+4255+e01a855c
mecab-ipadic AlmaLinux 8 2.7.0.20070801-17.module_el8.10.0+4060+d4256e26
mysql-common AlmaLinux 8 8.4.11-1.module_el8.10.0+4255+e01a855c
mysql-errmsg AlmaLinux 8 8.4.11-1.module_el8.10.0+4255+e01a855c
mysql-server AlmaLinux 8 8.4.11-1.module_el8.10.0+4255+e01a855c

almalinux advisories ALSA-2026:56936 ALSA-2026:56973 ALSA-2026:56007

mysql8.4 Rocky Linux 10 8.4.11-1.el10_2.rocky.0.1
mecab Rocky Linux 9 0.996-3.module+el9.8.0+40162+a76274f1.4
mecab Rocky Linux 9 0.996-3.module+el9.8.0+40205+77f4da59.4
rapidjson Rocky Linux 9 1.1.0-19.module+el9.8.0+40205+77f4da59
rapidjson Rocky Linux 9 1.1.0-19.module+el9.8.0+40162+a76274f1
mecab-ipadic Rocky Linux 9 2.7.0.20070801-24.module+el9.8.0+40162+a76274f1
mecab-ipadic Rocky Linux 9 2.7.0.20070801-24.module+el9.8.0+40205+77f4da59
perl-DBD-MySQL Rocky Linux 9 4.053-3.module+el9.8.0+40162+a76274f1

rocky linux advisories RLSA-2026:56007 RLSA-2026:56973 RLSA-2026:56936

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-47052 updated 2026-11-05 cvss 4.9

mysql: InnoDB unspecified vulnerability (CPU Jul 2026)

Red Hat Enterprise Linux AppStream (v. 8) mecab 0.996-2.module+el8.10.0+23550+bd321b9a, mysql 8.4.11-1.module+el8.10.0+24662+2d989aa9, mysql-libs 8.4.11-1.module+el8.10.0+24662+2d989aa9, mysql-test 8.4.11-1.module+el8.10.0+24662+2d989aa9, mysql-common 8.4.11-1.module+el8.10.0+24662+2d989aa9, mysql-errmsg 8.4.11-1.module+el8.10.0+24662+2d989aa9, +4 more
fixed: vendor fix RHSA-2026:56936
Red Hat Enterprise Linux AppStream (v. 9) mysql 8.4.11-1.module+el9.8.0+24663+27effc5a, mecab 0.996-3.module+el9.8.0+24348+9b27f387.4, rapidjson 1.1.0-19.module+el9.8.0+24348+9b27f387, mysql-libs 8.4.11-1.module+el9.8.0+24663+27effc5a, mysql-test 8.4.11-1.module+el9.8.0+24663+27effc5a, mysql-common 8.4.11-1.module+el9.8.0+24663+27effc5a, +6 more
fixed: vendor fix RHSA-2026:56973
Red Hat Enterprise Linux AppStream (v. 10) mysql8.4 8.4.11-1.el10_2, mysql8.4-libs 8.4.11-1.el10_2, mysql8.4-common 8.4.11-1.el10_2, mysql8.4-errmsg 8.4.11-1.el10_2, mysql8.4-server 8.4.11-1.el10_2 Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) mysql8.4-test 8.4.11-1.el10_2, mysql8.4-test-data 8.4.11-1.el10_2
fixed: vendor fix RHSA-2026:56007
Red Hat Enterprise Linux 6 mysql, mysql-libs, mysql-test, mysql-bench, mysql-server, mysql-embedded
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-23)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Oracle Corporation MySQL Server
Oracle Corporation MySQL Cluster

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

Technology feeds

MySQL rss critical rss

References

oracle.com /security-alerts/cpujul2026.html
vendor-advisory

Sources

CVE List CVE-2026-47052
NVD CVE-2026-47052

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary