CVE-2024-21194

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in the InnoDB component, resulting in complete denial of service for the MySQL Server process.

Why it matters to the business

Database services can be taken offline on demand, interrupting applications and business operations that depend on MySQL availability; the low EPSS and lack of KEV status indicate limited real-world urgency but still require prompt patching of affected 8.0/8.4/9.0 releases.

How an attack unfolds

An attacker who already possesses high-privileged network credentials connects to the MySQL instance over any supported protocol and sends a sequence of specially crafted requests that exercise the vulnerable code path inside InnoDB, causing the server process to hang or crash.

How to fix it

Upgrade MySQL Server to a version newer than 8.0.39, 8.4.2, or 9.0.1 as appropriate for the release line; apply the vendor-supplied patches that address the InnoDB denial-of-service condition.

How to confirm the fix worked

Confirm the installed MySQL version is newer than the affected releases listed in the advisory; run the vendor's diagnostic or regression test suite against InnoDB under load to verify the crash/hang condition no longer occurs.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL instance
2. Establish a connection using any supported protocol
3. Submit crafted requests that reach the vulnerable InnoDB code path
4. Trigger repeated crashes or a persistent hang to achieve denial of service

How to detect it

Inspect database server logs and monitoring systems for repeated unexpected shutdowns or crash signatures around the time of high-privileged connections; correlate with authentication events from privileged accounts.

What your security team should do

• Prioritize patching all MySQL 8.0, 8.4, and 9.0 instances within the next maintenance window
• Review database access controls to ensure only necessary high-privileged accounts exist
• Monitor for unexpected server restarts or availability alerts as an interim detection measure