CVE-2024-21008

What it actually does

The flaw in the MySQL Server Optimizer component allows a high-privileged network attacker to trigger a denial of service by causing the server to hang or crash repeatedly.

Why it matters to the business

Successful exploitation leads to database unavailability, disrupting applications and services that rely on MySQL and causing operational downtime; the vulnerability has been public for over 900 days with low and stable EPSS indicating limited active threat.

How an attack unfolds

An attacker with high database privileges connects via network protocols and crafts specific queries or operations that exploit the optimizer flaw to induce a crash or hang.

How to fix it

Upgrade affected MySQL Server installations (8.0.36 and prior, 8.3.0 and prior) to the latest patched releases provided by Oracle.

How to confirm the fix worked

Confirm MySQL version has been updated beyond the affected ranges and validate that targeted optimizer operations no longer produce crashes under high-privileged network access.

Typical attack path

1. Obtain high-privileged database access
2. Identify vulnerable MySQL version
3. Craft and send malicious optimizer-related queries over network
4. Trigger repeated crashes or hangs

How to detect it

Review MySQL error logs for repeated crash or hang entries tied to the optimizer component and correlate with connections from high-privileged accounts executing complex queries.

What your security team should do

• Apply latest Oracle MySQL patches immediately on all instances
• Restrict network exposure of MySQL servers to trusted sources only
• Review and minimize high-privileged accounts with network access
• Enable and monitor MySQL error and slow query logs for anomalous optimizer behavior