PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3256 Oracle CVE debrief

CVE-2017-3256 is a network-reachable availability issue in Oracle MySQL Server’s replication component. According to NVD, a low-privileged attacker can trigger a hang or repeatedly crash the server, causing a complete denial of service. The affected product scope covers Oracle MySQL 5.7.16 and earlier.

Vendor
Oracle
Product
CVE-2017-3256
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Database administrators, SREs, and platform owners running Oracle MySQL 5.7.16 or earlier, especially on servers exposed to untrusted networks or used in replication topologies.

Technical summary

NVD describes the issue as affecting the MySQL Server component, specifically Server: Replication. The attack vector is network-based and requires low privileges, with no user interaction. Successful exploitation can cause a hang or frequently repeatable crash, resulting in availability loss only. NVD classifies the weakness as CWE-20 (Improper Input Validation) and lists vulnerable Oracle MySQL versions up to and including 5.7.16.

Defensive priority

Medium severity, but higher operational priority for exposed or mission-critical MySQL servers because the impact is a repeatable service crash/hang.

Recommended defensive actions

  • Upgrade Oracle MySQL to a version newer than 5.7.16 using Oracle’s patched releases.
  • Inventory all MySQL instances and confirm whether they match the affected CPE range for Oracle MySQL up to 5.7.16.
  • Restrict network access to MySQL services so only trusted hosts and administration paths can reach them.
  • Review replication deployments for availability safeguards such as monitoring, restart automation, and failover procedures.
  • Apply vendor-supported downstream package updates where applicable, including distribution advisories referenced by NVD.

Evidence notes

The supplied NVD record states the affected CPE range (oracle:mysql:* through 5.7.16), the CVSS v3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the CWE-20 classification. NVD also references Oracle’s January 2017 CPU advisory as the vendor patch reference, plus downstream advisories from Red Hat and Gentoo.

Official resources

Publicly disclosed in January 2017 and recorded by CVE/NVD on 2017-01-27. The supplied NVD record was later modified on 2026-05-13; that later modification date is not the original issue date.