VIR Vulnerability Intelligence Relay

CVE-2026-34317

medium
Published 2026-04-21 · Modified 2026-05-05
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
5.0
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.0

Description

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Shell executes to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Shell. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).

Predictions

Exploit likelihood
50%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
debian debiansidfixed8.0.46-1

Application impact
VendorProductVersionsFixed
oracle oraclemysql{"startIncluding":"8.0.0","endIncluding":"8.0.45"}
oracle oraclemysql{"startIncluding":"8.4.0","endIncluding":"8.4.8"}
oracle oraclemysql{"startIncluding":"9.0.0","endIncluding":"9.6.0"}

References

CWEs

CWE-404

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.