SB20261110159 - Multiple vulnerabilities in MySQL Server

Description

This security bulletin contains information about 80 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-101748)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Audit component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

2) Improper input validation (CVE-ID: CVE-2026-101799)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Group Replication GCS component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

3) Improper input validation (CVE-ID: CVE-2026-101616)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: JSON component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

4) Improper input validation (CVE-ID: CVE-2026-101733)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: JSON component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

5) Improper input validation (CVE-ID: CVE-2026-101608)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

6) Improper input validation (CVE-ID: CVE-2026-101620)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

7) Improper input validation (CVE-ID: CVE-2026-101789)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

8) Improper input validation (CVE-ID: CVE-2026-101802)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Parser component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

9) Improper input validation (CVE-ID: CVE-2026-101728)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Pluggable Auth component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

10) Improper input validation (CVE-ID: CVE-2026-101774)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Server: Pluggable Auth component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

11) Improper input validation (CVE-ID: CVE-2026-101743)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: GIS component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

12) Improper input validation (CVE-ID: CVE-2026-101780)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: X Plugin component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

13) Improper input validation (CVE-ID: CVE-2026-101794)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: XML component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

14) Improper input validation (CVE-ID: CVE-2026-101803)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the Server: XML component in MySQL Cluster. A remote privileged user can exploit this vulnerability to damange or delete data.

15) Improper input validation (CVE-ID: CVE-2026-101788)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Components Services component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

16) Improper input validation (CVE-ID: CVE-2026-101761)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Encryption component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

17) Improper input validation (CVE-ID: CVE-2026-101637)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to damange or delete data.

18) Improper input validation (CVE-ID: CVE-2026-101777)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to access sensitive information or perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Encryption component in MySQL Cluster. A remote privileged user can exploit this vulnerability to access sensitive information or perform a denial of service (DoS) attack.

19) Improper input validation (CVE-ID: CVE-2026-101755)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Client programs component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

20) Improper input validation (CVE-ID: CVE-2026-101720)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Server: Connection Handling component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

21) Improper input validation (CVE-ID: CVE-2026-101796)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server: Replication component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

22) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-9547)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a man-in-the-middle attack.

The vulnerability exists due to improper validation of certificate with host mismatch in the CURLOPT_SSH_KEYFUNCTION callback when validating SSH host keys for SCP:// or SFTP:// transfers. A remote attacker can present a host key type that does not match the key type already recorded for the host in the known_hosts file to perform a man-in-the-middle attack.

Only libcurl-based applications built with the libssh backend and using the callback are vulnerable. The curl command line tool is not affected.

23) Stack-based buffer overflow (CVE-ID: CVE-2025-15467)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters. A remote attacker can supply a specially crafted CMS message with an oversized IV, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

24) Improper input validation (CVE-ID: CVE-2026-101781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server: Group Replication GCS component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

25) Improper input validation (CVE-ID: CVE-2026-101785)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server: JSON component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

26) Improper input validation (CVE-ID: CVE-2026-101770)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Client programs component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

27) Improper input validation (CVE-ID: CVE-2026-101771)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Client programs component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

28) Improper input validation (CVE-ID: CVE-2026-101772)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Client programs component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

29) Improper input validation (CVE-ID: CVE-2026-101679)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Client programs component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

30) Improper input validation (CVE-ID: CVE-2026-101797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Client: mysqldump component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

31) Improper input validation (CVE-ID: CVE-2026-101762)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Encryption component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

32) Improper input validation (CVE-ID: CVE-2026-101775)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Server: Replication component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

33) Improper input validation (CVE-ID: CVE-2026-101786)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to execute arbitrary code.

34) Improper input validation (CVE-ID: CVE-2026-101773)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Server: Group Replication Plugin component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

35) Improper input validation (CVE-ID: CVE-2026-101800)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server: Security: Privileges component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to read and manipulate data.

36) Improper input validation (CVE-ID: CVE-2026-101795)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server: Components Services component in MySQL Cluster. A local privileged user can exploit this vulnerability to execute arbitrary code.

37) Improper input validation (CVE-ID: CVE-2026-101725)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the C API component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

38) Improper input validation (CVE-ID: CVE-2026-101726)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the C API component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

39) Improper input validation (CVE-ID: CVE-2026-101747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

40) Improper input validation (CVE-ID: CVE-2026-101778)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Components Services component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

41) Improper input validation (CVE-ID: CVE-2026-101754)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Client programs component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

42) Improper input validation (CVE-ID: CVE-2026-101731)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

43) Improper input validation (CVE-ID: CVE-2026-101732)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

44) Improper input validation (CVE-ID: CVE-2026-101784)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

45) Improper input validation (CVE-ID: CVE-2026-101787)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

46) Improper input validation (CVE-ID: CVE-2026-101798)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

47) Improper input validation (CVE-ID: CVE-2026-101801)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

48) Improper input validation (CVE-ID: CVE-2026-101727)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Replication component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

49) Improper input validation (CVE-ID: CVE-2026-101729)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Replication component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

50) Improper input validation (CVE-ID: CVE-2026-101749)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Encryption component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

51) Improper input validation (CVE-ID: CVE-2026-101730)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

52) Improper input validation (CVE-ID: CVE-2026-101609)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

53) Improper input validation (CVE-ID: CVE-2026-101611)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

54) Improper input validation (CVE-ID: CVE-2026-101615)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A local privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

55) Improper input validation (CVE-ID: CVE-2026-101627)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

56) Improper input validation (CVE-ID: CVE-2026-101752)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Components Services component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

57) Improper input validation (CVE-ID: CVE-2026-101753)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: RAPID component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

58) Improper input validation (CVE-ID: CVE-2026-101766)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Replication component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

59) Improper input validation (CVE-ID: CVE-2026-101722)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Server: Connection Handling component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

60) Improper input validation (CVE-ID: CVE-2026-101612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A local privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

61) Improper input validation (CVE-ID: CVE-2026-101760)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

62) Improper input validation (CVE-ID: CVE-2026-101614)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

63) Improper input validation (CVE-ID: CVE-2026-101617)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

64) Improper input validation (CVE-ID: CVE-2026-101618)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

65) Improper input validation (CVE-ID: CVE-2026-101619)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

66) Improper input validation (CVE-ID: CVE-2026-101621)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

67) Improper input validation (CVE-ID: CVE-2026-101622)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

68) Improper input validation (CVE-ID: CVE-2026-101624)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

69) Improper input validation (CVE-ID: CVE-2026-101629)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

70) Improper input validation (CVE-ID: CVE-2026-101724)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

71) Improper input validation (CVE-ID: CVE-2026-101779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform service disruption.

The vulnerability exists due to improper input validation within the Server: Telemetry component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform service disruption.

72) Improper input validation (CVE-ID: CVE-2026-101750)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Clone Plugin component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

73) Improper input validation (CVE-ID: CVE-2026-101721)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Components Services component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

74) Improper input validation (CVE-ID: CVE-2026-101613)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DDL component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

75) Improper input validation (CVE-ID: CVE-2026-101756)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: GIS component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

76) Improper input validation (CVE-ID: CVE-2026-101751)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Group Replication GCS component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

77) Improper input validation (CVE-ID: CVE-2026-101776)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Group Replication Plugin component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

78) Improper input validation (CVE-ID: CVE-2026-101607)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

79) Improper input validation (CVE-ID: CVE-2026-101610)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

80) Improper input validation (CVE-ID: CVE-2026-101623)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Cluster. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuoct2026.html