CVE-2026-60184

What it actually does

The vulnerability in the replication component allows a high-privileged network attacker to trigger a denial of service by causing the MySQL server or cluster to hang or crash repeatedly.

Why it matters to the business

Successful exploitation can lead to downtime of database services, impacting application availability and requiring administrative intervention to restore, with elevated urgency due to 97 days since publication despite low EPSS.

How an attack unfolds

An attacker with high privileges and network access crafts malicious replication-related requests over supported protocols to exploit the flaw in the server replication logic, resulting in a crash or hang.

How to fix it

Upgrade affected MySQL Server 8.4.x to 8.4.11 or later and MySQL Cluster 8.0.x/8.4.x/9.7.x to corresponding fixed releases; for Red Hat systems apply mysql8.4 (redhat el10): fixed in 8.4.11-1.el10_2 via RHSA-2026:56007.

How to confirm the fix worked

Verify installed package versions against the fixed releases listed in vendor advisories, inspect replication configuration and logs post-upgrade, and conduct controlled replication tests to confirm stability.

Typical attack path

1. Obtain high-privileged network access to affected MySQL instance
2. Identify replication configuration and supported protocols
3. Craft and transmit malicious replication messages
4. Trigger hang or repeatable crash resulting in complete DoS

How to detect it

Review database error and replication logs for unexpected crashes or hangs, monitor system resource exhaustion patterns tied to replication traffic, and audit privileged command execution over network protocols.

What your security team should do

• Apply available updates to fixed versions without delay
• Restrict network exposure of MySQL ports to trusted sources only
• Audit and minimize high-privileged accounts with replication access
• Enable enhanced logging for replication events and monitor for anomalies