CVE-2024-21009

What it actually does

High-privileged network attacker can trigger repeated hangs or crashes in the MySQL Server Optimizer component, resulting in complete denial of service.

Why it matters to the business

Causes unplanned database downtime affecting applications and services that depend on MySQL, though risk remains low due to high-privilege requirement, stable low EPSS, and absence from KEV.

How an attack unfolds

An attacker who already possesses high database privileges connects over the network using supported protocols and submits crafted queries that exercise the Optimizer component, forcing the server into a hang or crash state.

How to fix it

Upgrade affected MySQL Server installations to patched releases beyond 8.0.36 and 8.3.0; apply the latest cumulative patches from Oracle for the 8.0 and 8.3 branches.

How to confirm the fix worked

Confirm the running MySQL version is newer than the affected releases, review release notes for Optimizer fixes, and test that normal privileged operations no longer trigger crashes.

Typical attack path

1. Acquire high-privileged MySQL credentials
2. Establish authenticated network connection to the target server
3. Submit specially crafted queries that reach the Optimizer
4. Induce repeated crashes or hangs to achieve denial of service

How to detect it

Monitor MySQL error logs for repeated Optimizer-related crashes or hang messages, correlate with privileged session activity, and watch for sudden spikes in connection resets from authenticated users.

What your security team should do

• Prioritize patching of internet-facing or business-critical MySQL instances
• Enforce least-privilege access and rotate high-privileged accounts
• Restrict network access to the MySQL port to trusted sources only
• Enable and centrally collect MySQL error and slow-query logs for anomaly detection