CVE-2024-20993

What it actually does

The vulnerability in the MySQL Server Optimizer component allows a high-privileged network attacker to trigger a hang or repeatable crash resulting in complete denial of service.

Why it matters to the business

Exploitation can cause extended database downtime that interrupts dependent applications and business processes, though low EPSS and absence from KEV indicate limited real-world exploitation risk.

How an attack unfolds

A high-privileged attacker with network access authenticates via supported protocols and submits crafted requests that abuse the optimizer to force the server into a hang or crash state.

How to fix it

Upgrade MySQL Server installations to patched releases beyond 8.0.35 and 8.2.0 and apply the latest cumulative security updates.

How to confirm the fix worked

Confirm server version exceeds the affected releases, review release notes for the fix, and perform controlled load testing to verify stability under optimizer-heavy workloads.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish authenticated network session to the MySQL instance
3. Submit specially crafted optimizer-triggering statements
4. Induce server hang or crash

How to detect it

Examine MySQL error logs, general query logs, and audit logs for clusters of privileged connections or optimizer-related statements immediately preceding unexpected server restarts or hangs.

What your security team should do

• Prioritize patching of internet-facing or high-value MySQL instances
• Enforce least-privilege database accounts and network segmentation
• Enable comprehensive audit logging for privileged sessions
• Monitor for anomalous crash patterns in database logs