CVE-2024-21201

What it actually does

The flaw in the MySQL Server Optimizer component permits a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Database unavailability disrupts dependent applications and services; the 44 downstream dependents increase the scope of operational impact across the ecosystem.

How an attack unfolds

An attacker with high privileges obtains network access via multiple protocols and supplies crafted inputs to the optimizer, causing the server to hang or crash. No known threat actors or ransomware campaigns are associated, and EPSS remains low and stable.

How to fix it

Upgrade affected MySQL Server installations to versions later than 8.0.39, 8.4.2, and 9.0.1 respectively. Apply the update as soon as possible given the CISA-style remediation expectations for availability-impacting issues.

How to confirm the fix worked

Verify the running MySQL version is no longer within the affected ranges (8.0.39 and prior, 8.4.2 and prior, 9.0.1 and prior) and confirm the Optimizer component no longer exhibits the crash behavior under equivalent privileged network requests.

Typical attack path

1. Obtain high-privileged network credentials for MySQL
2. Establish a connection using supported protocols
3. Submit specially crafted optimizer-related requests
4. Trigger server hang or crash to achieve denial of service

How to detect it

Review MySQL error logs and process crash dumps for optimizer-related faults; correlate with privileged network connections around the time of any unexpected server restarts or hangs.

What your security team should do

• Prioritize patching within the next maintenance window due to the availability impact and ecosystem prevalence
• Restrict high-privileged network access to MySQL instances to the minimum necessary hosts
• Monitor for unusual optimizer-related query patterns or sudden server restarts