CVE-2026-34317 Denial of service in MySQL Shell
A local attacker can cause a complete denial of service in MySQL Shell by exploiting a flaw that requires user interaction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34317?
CVE-2026-34317 is a medium-severity denial of service vulnerability in Oracle Mysql, published on 21 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Shell executes to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Shell. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).
Weakness: CWE-404
Which versions are affected by CVE-2026-34317?
1 open source package ship an affected version, including mysql-shell. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mysql-shell Bitnami | All versions | 8.0.46, 8.4.9, 9.7.0 |
Products include Oracle Mysql.
How do I fix CVE-2026-34317?
Upgrade mysql-shell to a fixed version for your release line: 8.0.46, 8.4.9 or 9.7.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-34317 being exploited?
There is no known exploitation of CVE-2026-34317 in the wild and no public exploit code.
Other vulnerabilities in Oracle Mysql
Sources
Also known as BIT-mysql-shell-2026-34317, GHSA-qhr7-4g47-87m7, UBUNTU-CVE-2026-34317.