CVE-2026-35237

CVE-2026-35237 is a denial-of-service vulnerability affecting Oracle MySQL Server's InnoDB component across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The vulnerability allows a high-privileged attacker with network access via multiple protocols to cause the MySQL Server to hang or crash repeatedly, resulting in complete service unavailability. The vulnerability has a CVSS 3.1 Base Score of 4.9 (MEDIUM severity) with a network attack vector and low attack complexity, but requires high privileges to exploit. The attack has no impact on confidentiality or integrity, affecting only availability. The relatively low EPSS score of 0.00034 indicates minimal real-world exploitation likelihood compared to other known vulnerabilities. There is currently no evidence of active exploitation, with the vulnerability absent from the CISA KEV catalog and marked as inactive on threat tracking lists. No public exploit code appears to be widely available, and community attention remains minimal based on the low FAUCET Risk Score of 31.0 out of 100. Organizations should prioritize patching based on their reliance on affected MySQL versions and the presence of high-privileged database users.