CVE-2024-21199

What it actually does

Allows a high-privileged network attacker to trigger a hang or repeatable crash in the InnoDB storage engine, resulting in complete denial of service for the MySQL Server.

Why it matters to the business

Leads to unplanned database downtime, interrupting dependent applications and services until the server is restarted; the stable low EPSS and lack of KEV status reduce immediate widespread risk but high-privilege exposure still demands prompt attention given broad MySQL deployment.

How an attack unfolds

An attacker with high privileges authenticates to the MySQL server and sends specially crafted queries or commands via supported protocols to exploit the InnoDB vulnerability, causing the server process to hang or crash; no named threat actors are associated with this issue.

How to fix it

Upgrade affected MySQL Server installations to versions beyond 8.0.39, 8.4.2, and 9.0.1 using the patches released by Oracle; restrict unnecessary high-privileged network access as a compensating control.

How to confirm the fix worked

Confirm the installed MySQL version exceeds the listed affected releases, review release notes for the specific fix, and perform stability testing under privileged workloads.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connection using supported protocols
3. Issue malicious commands targeting the InnoDB component
4. Trigger hang or crash resulting in denial of service

How to detect it

Review MySQL error logs for InnoDB-related assertion failures or unexpected crashes following connections from high-privileged accounts; examine general query and audit logs for patterns of unusual privileged activity around the time of service interruption.

What your security team should do

• Apply the Oracle-supplied patches to all MySQL instances without delay
• Audit and reduce the number of accounts with high privileges and network access
• Enable detailed error and audit logging to detect anomalous crashes