CVE-2024-21130

What it actually does

Flaw in the MySQL Server Optimizer allows a high-privileged network attacker to trigger repeated crashes or hangs that render the server unavailable.

Why it matters to the business

Successful exploitation leads to unplanned database outages that interrupt applications, reporting, and any dependent services until the server is restarted.

How an attack unfolds

An attacker with high-privileged network credentials connects to an affected MySQL instance and issues specially crafted queries that exercise the vulnerable optimizer path, causing the server process to hang or terminate.

How to fix it

Upgrade MySQL Server to a version newer than 8.0.37 for the 8.0 branch or newer than 8.4.0 for the 8.4 branch. Apply vendor patches as soon as they become available and test in a non-production environment first.

How to confirm the fix worked

After patching, verify the running server version reports a fixed release, review release notes for the optimizer fix, and confirm that previously reproducible crash queries no longer cause termination.

Typical attack path

1. Obtain or compromise a high-privileged MySQL account with network access
2. Connect to the target MySQL Server using supported protocols
3. Submit queries engineered to trigger the optimizer defect
4. Repeat until the server hangs or crashes, achieving denial of service

How to detect it

Inspect MySQL error logs and system logs for repeated abnormal terminations or hang messages around the optimizer component; correlate with connection records from high-privileged accounts.

What your security team should do

• Prioritize patching internet-facing or business-critical MySQL instances within the next maintenance window
• Restrict high-privileged accounts to trusted networks and require strong authentication
• Monitor for unexpected MySQL process restarts or availability alerts
• Review and reduce the number of accounts holding high privileges