CVE-2026-34319

CVE-2026-34319 is a denial-of-service vulnerability affecting Oracle MySQL Shell across multiple versions (8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0). The vulnerability resides in the Shell Core Client component and allows a low-privileged local attacker to cause the application to hang or crash repeatedly, completely denying service to legitimate users. The attack requires local access to the infrastructure where MySQL Shell executes and low privileges, making it relatively easy to exploit. However, successful exploitation requires user interaction from someone other than the attacker, which adds friction to attack execution. The vulnerability carries a CVSS 3.1 score of 5.0 (Medium severity) with impacts limited to availability, while maintaining no impact on confidentiality or integrity of data. There is no evidence of active exploitation in the wild, and this vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00013 indicates minimal probability of exploitation, and the vulnerability remains inactive on security vendor hotlists. Organizations should prioritize patching based on their risk tolerance and operational context, though the relatively low threat profile suggests this is not an urgent threat requiring immediate remediation.