{"id":"CVE-2026-21965","aliases":["BELL-CVE-2026-21965","EUVD-2026-3547","GHSA-j7pc-6x9v-m63m","UBUNTU-CVE-2026-21965"],"status":"published","title":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). ...","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00362,"percentile":0.30365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-01-20T21:56:33Z","modified":"2026-10-29T10:45:39Z","affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mysql-5.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.32-0ubuntu7","5.5.34-0ubuntu1","5.5.34-0ubuntu2","5.5.35-0ubuntu1","5.5.35+dfsg-1ubuntu1","5.5.37-0ubuntu0.14.04.1","5.5.38-0ubuntu0.14.04.1","5.5.40-0ubuntu0.14.04.1","5.5.41-0ubuntu0.14.04.1","5.5.43-0ubuntu0.14.04.1","5.5.44-0ubuntu0.14.04.1","5.5.46-0ubuntu0.14.04.2","5.5.47-0ubuntu0.14.04.1","5.5.49-0ubuntu0.14.04.1","5.5.50-0ubuntu0.14.04.1","5.5.52-0ubuntu0.14.04.1","5.5.53-0ubuntu0.14.04.1","5.5.54-0ubuntu0.14.04.1","5.5.55-0ubuntu0.14.04.1","5.5.57-0ubuntu0.14.04.1","5.5.58-0ubuntu0.14.04.1","5.5.59-0ubuntu0.14.04.1","5.5.60-0ubuntu0.14.04.1","5.5.61-0ubuntu0.14.04.1","5.5.62-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mysql-5.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.11-0ubuntu4","5.7.11-0ubuntu5","5.7.11-0ubuntu6","5.7.12-0ubuntu1","5.7.12-0ubuntu1.1","5.7.13-0ubuntu0.16.04.2","5.7.15-0ubuntu0.16.04.1","5.7.16-0ubuntu0.16.04.1","5.7.17-0ubuntu0.16.04.1","5.7.17-0ubuntu0.16.04.2","5.7.18-0ubuntu0.16.04.1","5.7.19-0ubuntu0.16.04.1","5.7.20-0ubuntu0.16.04.1","5.7.21-0ubuntu0.16.04.1","5.7.22-0ubuntu0.16.04.1","5.7.23-0ubuntu0.16.04.1","5.7.24-0ubuntu0.16.04.1","5.7.25-0ubuntu0.16.04.2","5.7.26-0ubuntu0.16.04.1","5.7.27-0ubuntu0.16.04.1","5.7.28-0ubuntu0.16.04.2","5.7.29-0ubuntu0.16.04.1","5.7.30-0ubuntu0.16.04.1","5.7.31-0ubuntu0.16.04.1","5.7.32-0ubuntu0.16.04.1","5.7.33-0ubuntu0.16.04.1","5.7.35-0ubuntu0.16.04.1+esm1","5.7.36-0ubuntu0.16.04.1+esm1","5.7.37-0ubuntu0.16.04.1+esm1","5.7.38-0ubuntu0.16.04.1+esm1","5.7.39-0ubuntu0.16.04.1+esm2","5.7.40-0ubuntu0.16.04.1+esm1","5.7.41-0ubuntu0.16.04.1+esm1","5.7.42-0ubuntu0.16.04.1+esm1","5.7.43-0ubuntu0.16.04.1+esm1","5.7.44-0ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"percona-server-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.22-rel71.0-0ubuntu2","5.6.22-rel71.0-0ubuntu4","5.6.22-rel71.0-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"percona-xtradb-cluster-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.21-25.8-0ubuntu2","5.6.21-25.8-0ubuntu3","5.6.21-25.8-0ubuntu3.1","5.6.21-25.8-0ubuntu3.2","5.6.34-26.19-0ubuntu0.16.04.1","5.6.34-26.19-0ubuntu0.16.04.2","5.6.37-26.21-0ubuntu0.16.04.1","5.6.37-26.21-0ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mysql-5.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.19-0ubuntu1","5.7.20-0ubuntu0.17.10.1","5.7.20-1ubuntu1","5.7.21-1ubuntu1","5.7.22-0ubuntu18.04.1","5.7.23-0ubuntu0.18.04.1","5.7.24-0ubuntu0.18.04.1","5.7.25-0ubuntu0.18.04.2","5.7.26-0ubuntu0.18.04.1","5.7.27-0ubuntu0.18.04.1","5.7.28-0ubuntu0.18.04.4","5.7.29-0ubuntu0.18.04.1","5.7.30-0ubuntu0.18.04.1","5.7.31-0ubuntu0.18.04.1","5.7.32-0ubuntu0.18.04.1","5.7.33-0ubuntu0.18.04.1","5.7.34-0ubuntu0.18.04.1","5.7.35-0ubuntu0.18.04.1","5.7.35-0ubuntu0.18.04.2","5.7.36-0ubuntu0.18.04.1","5.7.37-0ubuntu0.18.04.1","5.7.38-0ubuntu0.18.04.1","5.7.39-0ubuntu0.18.04.2","5.7.40-0ubuntu0.18.04.1","5.7.41-0ubuntu0.18.04.1","5.7.42-0ubuntu0.18.04.1","5.7.43-0ubuntu0.18.04.1+esm1","5.7.44-0ubuntu0.18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mariadb-10.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.3.17-1","1:10.3.18-1","1:10.3.19-1","1:10.3.21-2","1:10.3.22-1","1:10.3.22-1ubuntu1","1:10.3.25-0ubuntu0.20.04.1","1:10.3.29-0ubuntu0.20.04.1","1:10.3.30-0ubuntu0.20.04.1","1:10.3.31-0ubuntu0.20.04.1","1:10.3.32-0ubuntu0.20.04.1","1:10.3.34-0ubuntu0.20.04.1","1:10.3.37-0ubuntu0.20.04.1","1:10.3.38-0ubuntu0.20.04.1","1:10.3.39-0ubuntu0.20.04.2"]}],"products":[{"vendor":"oracle","product":"mysql_server"},{"vendor":"oracle corporation","product":"mysql server"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2026.html","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21965","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j7pc-6x9v-m63m"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-21965","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21965.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-21965","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21965","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-21965","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-01-20T21:56:33.583Z","modified":"2026-01-21T19:57:30.139Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-3547","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-01-20T21:56:33Z","modified":"2026-01-21T19:57:30Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:48:49.473592Z"}],"ghsa":[{"id":"GHSA-j7pc-6x9v-m63m","title":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). ...","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-01-21T00:31:43Z","modified":"2026-01-21T00:31:50Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:05:50.116831Z"}],"nvd":[{"id":"CVE-2026-21965","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-01-20T22:15:59.487Z","modified":"2026-06-17T10:19:14.883Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:04.423757Z"}],"osv":[{"id":"BELL-CVE-2026-21965","title":"CVE-2026-21965 does not affect BellSoft software","status":"withdrawn","published":"2026-01-23T06:08:43.302226Z","modified":"2026-01-29T07:30:01.905053Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-21965","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-01-20T21:56:33.583Z","modified":"2026-10-29T10:45:39.693282656Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"UBUNTU-CVE-2026-21965","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-01-20T22:15:00Z","modified":"2026-04-22T16:14:38.216665Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:56:01.334185Z"}]}}