CVE-2026-22009

CVE-2026-22009 is a denial-of-service vulnerability in Oracle MySQL Server's Optimizer component affecting versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The flaw allows a low-privileged attacker with network access to trigger server hangs or repeated crashes, resulting in complete service unavailability. This vulnerability carries a CVSS 3.1 score of 6.5 (Medium severity) with an easily exploitable attack profile requiring only network access and low-level privileges, with no user interaction necessary. The attack vector is network-based with low complexity, meaning exploitation requires minimal effort once an attacker gains basic database access. The vulnerability exclusively impacts availability, with no confidentiality or integrity compromise possible. The low EPSS score of 0.0004 and inactive status on the CISA Known Exploited Vulnerabilities list indicate minimal real-world exploitation activity to date. Organizations should prioritize patching based on standard patch management cycles, though the absence of active exploitation reduces immediate risk compared to higher-severity vulnerabilities.