Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-101678: MySQL Connector/J 26.7.0 can cause partial service loss
CVE-2026-101678 · published 15 days ago
Summary
The MySQL Connector/J library version 26.7.0, used by Oracle MySQL Connectors and several Linux distributions, can be tricked by someone on the network into stopping part of its work. The flaw does not require a login, but the attacker must convince a user to click something first. Apply the vendor’s update or replace the library with a newer version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | oracle corporation | mysql connectors | 26.7.0 |
| Ubuntu:14.04:LTS | canonical | mysql-5.5 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | mysql-5.7 | All versions |
| Ubuntu:16.04:LTS | canonical | mariadb-10.0 | All versions |
| Ubuntu:16.04:LTS | canonical | percona-server-5.6 | All versions |
| Ubuntu:16.04:LTS | canonical | percona-xtradb-cluster-5.6 | All versions |
| Ubuntu:18.04:LTS | canonical | mariadb-10.1 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | mysql-8.0 | All versions |
| Ubuntu:20.04:LTS | canonical | mariadb-10.3 | All versions |
| Ubuntu:22.04:LTS | canonical | mariadb-10.6 | All versions |
| Ubuntu:24.04:LTS | canonical | mariadb | All versions |
| Ubuntu:26.10 | canonical | mysql-9.7 | All versions |
| Ubuntu:26.04:LTS | canonical | mysql-8.4 | All versions |
Original advisory text
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated a...
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
References
- https://www.oracle.com/security-alerts/cpuoct2026.html
- https://ubuntu.com/security/CVE-2026-101678 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-101678 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Track software like this
Free during beta