CVE-2024-21055

What it actually does

A flaw in the MySQL Server Optimizer allows a high-privileged network attacker to submit crafted queries that trigger repeated crashes or hangs, resulting in complete denial of service.

Why it matters to the business

Database availability is lost until the service is restarted, causing operational downtime and potential data access interruptions for dependent applications.

How an attack unfolds

An attacker with high database privileges connects over the network and issues specially constructed queries that exercise a vulnerable code path in the optimizer, causing the server process to hang or terminate.

How to fix it

Upgrade MySQL Server to the latest patched release that resolves the optimizer issue; apply vendor security updates promptly and restrict high-privilege accounts to trusted networks.

How to confirm the fix worked

Confirm the installed MySQL version is newer than 8.0.35, review release notes for the optimizer fix, and test that crafted queries no longer cause crashes in a staging environment.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connection to MySQL using supported protocols
3. Submit crafted queries targeting the optimizer component
4. Trigger repeated crashes or hangs to sustain denial of service

How to detect it

Review database logs and system event logs for unexpected MySQL process terminations or repeated restarts coinciding with query activity from privileged accounts.

What your security team should do

• Prioritize patching MySQL instances exposed to untrusted networks
• Limit high-privilege accounts and enforce network access controls
• Monitor for unexpected MySQL process restarts or hangs
• Include this component in regular vulnerability scanning cycles