CVE-2026-46862: MySQL Router TLS Denial-of-Service Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-46862 is a denial-of-service flaw in MySQL Router's TLS handling, classified under improper resource exhaustion (CWE-400). The vulnerability permits unauthenticated, network-based attackers to trigger uncontrolled consumption or crash conditions in the Router process via malformed or adversarial TLS handshakes or payloads. The low attack complexity and lack of privilege requirements mean minimal barriers to exploitation. The scope remains unchanged—only the Router availability is compromised, not data confidentiality or integrity. CVSS 3.1 score of 7.5 reflects the high availability impact across network-accessible instances.

Business impact

MySQL Router is frequently deployed as a connection pooler, load balancer, and high-availability layer between applications and MySQL database clusters. A successful attack that crashes or hangs the Router forces application failover logic to activate, potentially causing service degradation, transaction delays, or temporary unavailability depending on application resilience design. In environments where Router is the sole connection gateway, impact is amplified. Repeated exploitation can degrade operational reliability and increase support burden. Data loss or breach risk is minimal, but operational continuity and customer-facing uptime are directly threatened.

Affected systems

MySQL Router versions 8.4.0 through 8.4.9, and 9.0.0 through 9.7.0 are affected. The vulnerability requires network access to the TLS port on which Router listens (typically port 6446 or 6447 for classic MySQL protocol, or 6448/6449 for X Protocol). Only versions within those ranges are vulnerable; earlier release lines (8.0.x, 8.2.x, 8.3.x) and any patched versions released after 9.7.0 should be evaluated against vendor advisories. Deployments using Router in internal-only networks still face risk if any untrusted network segment or compromised host can reach the Router service.

Exploitability

This vulnerability is easily exploitable. No user authentication, valid credentials, or interaction is required. An attacker simply needs network access to the TLS port on which MySQL Router listens. The attack is repeatable and deterministic, making it straightforward to weaponize once the specific TLS payload or handshake condition is identified. However, the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not been widely reported or is not yet confirmed. Nonetheless, the low barrier to exploitation means patching should proceed with urgency once fixes are available.

Remediation

Upgrade MySQL Router to a patched version released by Oracle that addresses this TLS handling issue. Consult Oracle's official security advisory for exact version numbers and patch availability. Until patching is feasible, implement network-level mitigations: restrict TLS port access via firewall rules to trusted application hosts, isolate Router instances on secure internal networks, and implement rate limiting or connection throttling to reduce denial-of-service surface. Monitor Router process logs and system metrics for abnormal crashes or hangs that may indicate exploitation attempts. Test patches in non-production environments before production deployment to ensure compatibility with existing applications.

Patch guidance

Verify the availability of patched versions from Oracle MySQL via their official security advisories page. Typical patch guidance includes: (1) identify your current Router version via 'mysqlrouter --version'; (2) review Oracle's advisory for the specific patched version targeting your branch (8.4.x or 9.x); (3) backup Router configuration and certificates before upgrading; (4) test the patched version in a staging environment mirroring production topology; (5) deploy to production during a maintenance window, monitoring for connection stability immediately after; (6) validate that applications resume normal database connectivity and that no hung connections remain. If immediate patching is blocked, implement compensating controls (firewall restrictions, network segmentation) while preparing the upgrade.

Detection guidance

Monitor MySQL Router process behavior for unexpected crashes or hangs, particularly correlating with network traffic spikes on the TLS listening port. Enable Router debug logging (if available) to capture TLS handshake errors or abnormal connection terminations. Check system logs (syslog, event viewer) for Router process exit codes or segmentation faults. Network-level detection: monitor for high volumes of failed TLS connections, malformed TLS handshakes, or incomplete TLS sessions originating from untrusted IPs targeting the Router port. Intrusion detection systems sensitive to TLS anomalies may flag suspicious handshake patterns. Implement alerting on Router restart frequency—a spike in restarts suggests active exploitation or repeated crashes.

Why prioritize this

This vulnerability merits HIGH priority due to its high CVSS score (7.5), easy exploitability, lack of authentication requirements, and direct impact on service availability. MySQL Router is a critical component in many production database architectures; its compromise disrupts application connectivity even though data is not directly exposed. While KEV status is not confirmed, the low attack complexity and broad network-accessible scope mean it could be leveraged quickly. Organizations should prioritize patching in the near term to reduce operational risk, particularly for internet-facing or multi-tenant environments where Router isolation is weaker.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by: Network attack vector (AV:N) reflecting internet accessibility; low attack complexity (AC:L) indicating minimal technical effort; no privileges required (PR:N) and no user interaction (UI:N); high availability impact (A:H) due to reliable crash/hang conditions; and unchanged scope (S:U) limiting blast radius to Router only. Confidentiality and integrity are not impacted (C:N, I:N), so the score does not reach CRITICAL. However, the availability impact is severe for dependent applications, justifying the HIGH severity classification and urgent patching timeline.

Frequently asked questions