CVE-2026-22005

CVE-2026-22005 is a vulnerability in Oracle MySQL Server's Optimizer component affecting versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The flaw allows high-privileged attackers with network access to trigger a denial-of-service condition by causing the MySQL Server to hang or crash repeatedly, though no confidentiality or integrity impacts are present. The vulnerability carries a CVSS 3.1 base score of 4.9 (Medium severity) and is easily exploitable through multiple network protocols. It requires high privileges and has low attack complexity, with the primary impact being service unavailability rather than data compromise. The attack requires neither user interaction nor system-level access. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community attention with very low exploit probability (EPSS score of 0.00037). There is no evidence of active exploitation or publicly available exploit code, suggesting this remains a low-risk threat in operational environments despite its technical feasibility for privileged users.