CVE-2026-22017

CVE-2026-22017 is a denial-of-service vulnerability in Oracle MySQL Server's Optimizer component affecting versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The flaw allows low-privileged attackers with network access to trigger server hangs or crashes through multiple protocols, completely disabling the affected MySQL instance. This represents an availability-focused threat rather than a confidentiality or integrity concern. The vulnerability carries a CVSS 3.1 base score of 6.5 (Medium severity) with a network attack vector and low complexity, requiring only low-level privileges and no user interaction. The attack is easily exploitable, making it accessible to relatively unsophisticated threat actors who can establish network connectivity to MySQL servers. The primary impact is complete denial of service through frequent, repeatable crashes. From an exploitation standpoint, CVE-2026-22017 does not appear to be actively exploited in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and maintains an EPSS score of 0.0004, indicating minimal real-world exploitation activity to date. Current community attention appears limited, suggesting this remains a lower-priority threat compared to actively exploited vulnerabilities, though organizations running affected MySQL versions should still apply patches to prevent potential future exploitation.