CVE-2024-21241

What it actually does

The flaw in the Server: Optimizer component of MySQL Server permits a high-privileged attacker with network access to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Disrupts database availability, potentially halting dependent applications and services; low urgency given stable low EPSS, no KEV listing, and over two years since publication.

How an attack unfolds

A high-privileged attacker connects to the MySQL Server over supported protocols and submits specially crafted queries that exploit weaknesses in the optimizer, leading to resource exhaustion or crash without requiring user interaction.

How to fix it

Upgrade affected MySQL Server versions (8.0.39 and prior, 8.4.2 and prior, 9.0.1 and prior) to patched releases; for org.apache.shiro:shiro-core (Maven) apply fixes in version 1.5.2.

How to confirm the fix worked

Verify MySQL Server version after upgrade and test optimizer workloads under load to confirm absence of crash conditions; scan Maven dependencies for shiro-core versions prior to 1.5.2.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL instance
2. Establish a connection using multiple supported protocols
3. Issue crafted optimizer-related queries or statements
4. Induce server hang or crash to achieve denial of service

How to detect it

Review MySQL error logs and slow query logs for repeated optimizer-related crashes or hangs; inspect application logs for connection patterns from privileged accounts coinciding with availability incidents.

What your security team should do

• Prioritize patching MySQL Server instances with external network exposure
• Review and restrict high-privileged accounts with network access
• Monitor for availability anomalies in database logs
• Update shiro-core dependencies to 1.5.2 across all Maven projects