CVE-2026-22004

CVE-2026-22004 is a denial-of-service vulnerability affecting Oracle MySQL Server versions 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0, specifically within the InnoDB component. The vulnerability allows a high-privileged attacker with network access via multiple protocols to trigger a hang or repetitive crash of the MySQL Server, resulting in complete service unavailability. The vulnerability presents a medium-severity risk with a CVSS 3.1 base score of 4.9. It requires network access and high-level privileges but is easily exploitable with low attack complexity and no user interaction needed. The impact is limited to availability, with no confidentiality or integrity compromise possible. This vulnerability currently shows minimal exploitation activity in the wild, with an extremely low EPSS score of 0.0004 and no listing on the Known Exploited Vulnerabilities catalog. The FAUCET Risk Score of 31.0/100 and inactive status on threat intelligence hot lists indicate low community attention and no publicly available proof-of-concept exploit code at this time.