VYPR
← All advisories
Medium severity4.9NVD Advisory· Published Aug 8, 2017· Updated May 13, 2026

CVE-2017-3641

CVE-2017-3641

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A high-privileged attacker with network access can trigger a hang or crash of MySQL Server via the DML component in versions 5.5.56, 5.6.36, and 5.7.18 and earlier.

Vulnerability

The vulnerability resides in the DML (Data Manipulation Language) component of MySQL Server. Affected versions include Oracle MySQL 5.5.56 and earlier, 5.6.36 and earlier, and 5.7.18 and earlier [description]. The vulnerability is exploitable without authentication beyond the required high privileges, and can be triggered via multiple network protocols such as MySQL protocol or others [description].

Exploitation

An attacker requires high-level privileges (such as those of a database administrator) on the MySQL server. The attacker can send crafted DML statements over the network to the server. Successful exploitation leads to a hang or frequently repeatable crash of the MySQL server, causing a complete denial of service [description]. No user interaction is required for the attack [description].

Impact

Successful exploitation results in a denial of service condition where the MySQL server becomes unresponsive or crashes repeatedly. The impact is limited to availability (CIA: Availability only), with no impact on confidentiality or integrity. The CVSS v3 base score is 4.9 (Medium), with an availability impact of High [description].

Mitigation

Oracle released patches as part of the July 2017 Critical Patch Update. Red Hat published errata RHSA-2017:2787, RHSA-2018:0279, RHSA-2018:0574, and RHSA-2018:2439 to address this issue across various Red Hat Enterprise Linux versions [1][2][3][4]. Users should upgrade to the fixed versions provided in those advisories. As of the available references, no workarounds are documented. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities catalog.

References
  1. https://access.redhat.com/errata/RHSA-2018:2439
  2. https://access.redhat.com/errata/RHSA-2018:0574
  3. https://access.redhat.com/errata/RHSA-2018:0279
  4. https://access.redhat.com/errata/RHSA-2017:2787

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

52

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.