Bug 2537328

Summary: CVE-2026-71079 mysql-connector-odbc: MySQL Connector/ODBC: Denial of Service via network access by a low privileged attacker [fedora-all]
Product: [Fedora] Fedora Reporter: Marian Rehak <mrehak>
Component: mysql-connector-odbcAssignee: Michal Schorm <mschorm>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: db-sig, hhorak, mschorm, psloboda
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["7e6f0499-6a8a-4710-ae48-80492d57ce54"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-25 22:56:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2519553    
Bug Blocks: 2519167    

Description Marian Rehak 2026-09-21 08:48:41 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Comment 1 Michal Schorm 2026-10-24 20:06:52 UTC 
The 26.10.0 release notes list only 2 bug fixes (Bug #40010434, Bug #39938996) — Oracle doesn't put CVE numbers in connector release notes, only in the CPU advisory.

The intermediate versions (26.7.0, 26.7.1) are also vulnerable.

26.10.0 should be compatible with both Server 8.4 and 9.7.
Comment 2 Michal Schorm 2026-10-25 20:40:15 UTC 
https://src.fedoraproject.org/rpms/mysql-connector-odbc/pull-request/13
Comment 3 Michal Schorm 2026-10-25 22:56:12 UTC 
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b5aa2f0e30