mysql: InnoDB unspecified vulnerability (CPU Apr 2026)
Published Apr 21, 2026
4.9
MEDIUMCVSS 3.1
EPSS 0.42%
Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Affected products
-
Affected
- ≥ 8.0.0, ≤ 8.0.45
- ≥ 8.4.0, ≤ 8.4.8
- ≥ 9.0.0, ≤ 9.6.0
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Oracle Corporation | MySQL Server | unknown | Affected
|
- ≥ 8.0.0 · ≤ 8.0.45
- ≥ 8.4.0 · ≤ 8.4.8
- ≥ 9.0.0 · ≤ 9.6.0
No data.
Red Hat Enterprise Linux 10
mysql8.4-0:8.4.9-1.el10_2
Fixed · RHSA-2026:20693
Red Hat Enterprise Linux 8
mysql:8.0-8100020260609092222.489197e6
Fixed · RHSA-2026:25919
Red Hat Enterprise Linux 8
mysql:8.4-8100020260526091138.489197e6
Fixed · RHSA-2026:26180
Red Hat Enterprise Linux 9
mysql-0:8.0.46-1.el9_8
Fixed · RHSA-2026:23332
Red Hat Enterprise Linux 9
mysql:8.4-9080020260602140041.rhel9
Fixed · RHSA-2026:25052
Red Hat Enterprise Linux 6
mysql
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | mysql8.4-0:8.4.9-1.el10_2 | Fixed | RHSA-2026:20693 |
| Red Hat Enterprise Linux 8 | mysql:8.0-8100020260609092222.489197e6 | Fixed | RHSA-2026:25919 |
| Red Hat Enterprise Linux 8 | mysql:8.4-8100020260526091138.489197e6 | Fixed | RHSA-2026:26180 |
| Red Hat Enterprise Linux 9 | mysql-0:8.0.46-1.el9_8 | Fixed | RHSA-2026:23332 |
| Red Hat Enterprise Linux 9 | mysql:8.4-9080020260602140041.rhel9 | Fixed | RHSA-2026:25052 |
| Red Hat Enterprise Linux 6 | mysql | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.
References (7)
- https://access.redhat.com/security/cve/CVE-2026-35237 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2460295 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24441 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-35237
- https://www.cve.org/CVERecord?id=CVE-2026-35237
- https://www.oracle.com/security-alerts/cpuapr2026.html vendor-advisoryVendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixMSQL
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub
No data