CVE-2025-21492

What it actually does

Flaw in the MySQL Server Optimizer component allows a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the database process.

Why it matters to the business

Database services become unavailable, interrupting applications and operations that depend on MySQL for data access and causing downtime until the server is restarted.

How an attack unfolds

An attacker with high privileges connects to the MySQL server over network protocols and submits specially crafted queries that exercise the vulnerable Optimizer code path, causing the server process to hang or crash.

How to fix it

Upgrade affected MySQL installations to fixed versions. For linux-azure on Ubuntu 24.04 LTS apply 6.8.0-1008.8 or later; for linux-gke on Ubuntu 24.04 LTS apply 6.8.0-1004.7 or later. Restrict network access and review privileged account usage until patches are applied.

How to confirm the fix worked

Verify MySQL and kernel package versions match or exceed the listed fixed releases, confirm the Optimizer-related crash conditions no longer reproduce under test workloads, and monitor service availability after deployment.

Typical attack path

1. Obtain high-privileged network access to the MySQL instance
2. Connect using supported protocols
3. Issue crafted queries that reach the Optimizer component
4. Trigger repeated crashes or hangs to sustain denial of service

How to detect it

Review MySQL error logs and system crash reports for repeated Optimizer-related failures or abrupt process terminations around the time of suspected incidents; correlate with privileged connection events in the database audit log.

What your security team should do

• Apply the specified kernel package updates immediately on all affected Ubuntu 24.04 systems running MySQL
• Limit network exposure of MySQL instances and enforce least-privilege access for database accounts
• Schedule validation testing in staging environments before production rollout
• Update asset inventories to track MySQL version distribution across the fleet