CVE-2026-34271

CVE-2026-34271 is a denial-of-service vulnerability in Oracle MySQL Server's Group Replication Plugin that affects versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The flaw allows a low-privileged attacker with network access to cause the MySQL Server to hang or crash repeatedly, completely disrupting availability. This vulnerability is easily exploitable and can be triggered through multiple network protocols without user interaction. The vulnerability carries a CVSS 3.1 base score of 6.5 (Medium severity), with a network-based attack vector requiring low privileges and minimal complexity. The attack has no impact on confidentiality or integrity but results in high availability impact through complete denial of service. The corresponding CVSS vector reflects these characteristics: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Currently, there is no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and its EPSS score of 0.0004 indicates minimal likelihood of future exploitation compared to other disclosed CVEs. Community attention appears limited at this time, though the medium severity rating and ease of exploitation warrant timely patching of affected MySQL instances.