CVE-2024-21238

What it actually does

Low-privileged network attacker can trigger a hang or repeatable crash in the MySQL Server thread pooling component, resulting in complete denial of service.

Why it matters to the business

Database services become unavailable, causing application downtime, interrupted transactions, and potential data-access loss until the server is restarted.

How an attack unfolds

An attacker with valid low-privileged credentials connects over any supported protocol and sends crafted requests that exploit a race or resource-handling flaw in the thread pool; successful triggering leads to server hang or crash. No public exploits or named threat actors are associated with this issue.

How to fix it

Upgrade MySQL Server to a version newer than 8.0.39, 8.4.1, or 9.0.1 as provided in the corresponding Oracle Critical Patch Update. Apply the fix promptly given the public disclosure date.

How to confirm the fix worked

Confirm the installed MySQL version is newer than the affected releases; review Oracle CPU notes for the specific build numbers that resolve the thread-pool issue and test connectivity and stability under load.

Typical attack path

1. Obtain low-privileged network credentials for a MySQL instance
2. Establish a connection via one of the supported protocols
3. Send specially crafted requests targeting the thread-pooling logic
4. Trigger resource exhaustion or deadlock resulting in hang or crash

How to detect it

Review MySQL error logs and system logs for repeated thread-pool warnings, sudden process terminations, or availability alerts around the time of suspected activity; correlate with authentication events from low-privileged accounts.

What your security team should do

• Prioritize patching all internet-facing or multi-tenant MySQL deployments within the next maintenance window
• Monitor Oracle release notes for the exact fixed builds and schedule upgrades accordingly
• Restrict network access to MySQL ports to trusted sources until patches are applied