CVE-2024-21062

What it actually does

The flaw in the MySQL Server Optimizer component permits a high-privileged network attacker to submit specially crafted queries that trigger repeated hangs or crashes, resulting in complete denial of service for the database instance.

Why it matters to the business

Database services become unavailable, halting dependent applications, transactions, and analytics workloads until the affected MySQL instance is restarted or recovered, with elevated urgency due to the 911 days since publication and stable low exploit probability.

How an attack unfolds

An attacker with high-privileged network credentials connects to the MySQL Server over supported protocols and issues optimizer-triggering queries that cause the server process to hang or crash repeatedly, denying service to legitimate users.

How to fix it

Apply the latest MySQL Server patches from Oracle for the 8.0 and 8.3 release lines that address the optimizer issue; test in a non-production environment before deploying to production instances.

How to confirm the fix worked

Confirm the running MySQL version is newer than 8.0.36 and 8.3.0, review release notes for the specific optimizer fix, and perform load testing with complex queries to verify stability under privilege levels that previously triggered the issue.

Typical attack path

1. Obtain high-privileged network credentials for a MySQL instance
2. Establish a connection using supported protocols
3. Submit crafted queries that exercise the vulnerable optimizer path
4. Observe or force repeated server hangs or crashes to sustain denial of service

How to detect it

Review MySQL error logs and crash dumps for repeated optimizer-related failures or stack traces matching the affected component; correlate with authentication events from high-privileged accounts during the same timeframe.

What your security team should do

• Prioritize patching all exposed MySQL 8.0 and 8.3 instances within standard change windows given the public disclosure age
• Restrict network access to MySQL ports to only trusted management hosts
• Review and minimize the number of high-privileged accounts with network connectivity
• Monitor database availability metrics for unexplained restarts or hangs