CVE-2024-20966

What it actually does

Flaw in the Optimizer component permits a high-privileged network attacker to submit inputs that trigger a hang or repeatable crash, terminating MySQL Server availability.

Why it matters to the business

Database instances become unavailable until restarted, interrupting dependent applications and services and requiring administrative intervention to restore operation.

How an attack unfolds

An attacker who already possesses high-privileged database credentials connects over the network and issues specially crafted statements that exercise the defective optimizer path, causing the server process to hang or terminate.

How to fix it

Upgrade affected MySQL Server installations to versions later than 8.0.35 and 8.2.0 respectively. Apply vendor-supplied patches as soon as available and verify the new version in production after staged testing.

How to confirm the fix worked

Confirm the running MySQL version is no longer in the affected range. Monitor server stability under load that previously triggered the issue and review release notes for explicit mention of the optimizer fix.

Typical attack path

1. Obtain high-privileged MySQL credentials
2. Establish network connection to the MySQL server using supported protocols
3. Submit crafted queries or statements that reach the vulnerable optimizer code path
4. Observe server hang or crash resulting in denial of service

How to detect it

Review MySQL error logs and crash reports for repeated optimizer failures or abrupt server terminations immediately following high-privileged connections. Correlate authentication events with subsequent availability alerts.

What your security team should do

• Prioritize patching all internet-facing and high-value MySQL instances within the next maintenance window
• Restrict high-privileged accounts to trusted networks or hosts only
• Enable and review MySQL error and crash logs for optimizer-related failures
• Test application workloads against patched versions before broad deployment