CVE-2025-21491

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in the InnoDB component, resulting in complete denial of service for the MySQL Server process.

Why it matters to the business

Database service becomes unavailable, causing application outages, potential data access loss, and operational disruption until the server is restarted; low exploitation probability reduces immediate urgency but high-privilege requirement still demands prompt patching.

How an attack unfolds

An attacker who already possesses high-privileged database credentials connects over any supported protocol and sends specially crafted requests that exercise a flaw in InnoDB, causing the server to hang or crash. No public exploits or named threat actors are associated with this issue.

How to fix it

Upgrade affected MySQL Server installations to versions later than 8.0.40, 8.4.3, or 9.1.0. Apply the latest stable release that includes the InnoDB fix; restart the service after upgrade and verify connectivity.

How to confirm the fix worked

Confirm the running MySQL version is newer than the listed affected releases; attempt to reproduce the crash with a high-privileged test account in a non-production environment to verify the issue no longer occurs.

Typical attack path

1. Obtain high-privileged MySQL credentials
2. Establish network connection to the MySQL server using a supported protocol
3. Transmit crafted protocol messages targeting the InnoDB component
4. Trigger hang or crash resulting in denial of service

How to detect it

Review MySQL error logs and system logs for repeated InnoDB-related crashes or abrupt process terminations; correlate with authentication events from high-privileged accounts around the same timestamps.

What your security team should do

• Prioritize upgrade of all MySQL instances to fixed releases within the next maintenance window
• Review and restrict network access to database ports to only trusted sources
• Audit high-privileged accounts and rotate credentials where possible
• Monitor for unusual connection patterns or repeated crashes in database logs