PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3273 Oracle CVE debrief

CVE-2017-3273 is a denial-of-service vulnerability in the MySQL Server component of Oracle MySQL. Oracle and NVD describe it as easily exploitable over the network by a low-privileged attacker, with impact limited to availability: affected servers can hang or crash repeatedly. The affected ranges listed by NVD are MySQL 5.6.34 and earlier, and 5.7.16 and earlier.

Vendor
Oracle
Product
Mysql
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

MySQL administrators, database platform owners, SRE/operations teams, and security teams responsible for Oracle MySQL deployments or downstream packages.

Technical summary

NVD maps this issue to CWE-20 and gives CVSS v3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is in Oracle MySQL Server, subcomponent Server: DDL. According to the CVE description, a low-privileged attacker with network access via multiple protocols can trigger a hang or a frequently repeatable crash, resulting in complete denial of service. NVD lists affected versions as 5.6.34 and earlier, and 5.7.16 and earlier.

Defensive priority

Medium

Recommended defensive actions

  • Inventory MySQL servers and confirm whether any instance is running Oracle MySQL 5.6.34 or earlier, or 5.7.16 or earlier.
  • Apply the Oracle CPU January 2017 update referenced by the vendor advisory, or the corresponding fixed downstream package from your distribution.
  • If you rely on vendor-packaged MySQL, review downstream advisories such as Red Hat or Gentoo to verify the patched package version.
  • Restrict network access to MySQL services and limit which low-privileged accounts can reach the server.
  • Monitor for unexpected MySQL hangs or repeatable crashes and include this CVE in incident and patch verification checks.

Evidence notes

The CVE description and NVD record both identify Oracle MySQL Server as the affected product and state that the issue can let a low-privileged attacker with network access cause a hang or repeatable crash. NVD lists the vulnerable version ranges as 5.6.34 and earlier, and 5.7.16 and earlier, and assigns CVSS v3.0 6.5 (AV:N/AC:L/PR:L/UI:N/A:H). The Oracle January 2017 CPU advisory is the vendor patch reference in the supplied source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3273 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3273

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3273 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3273

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.