CVE-2025-21493

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in MySQL Server by exploiting a privilege-handling flaw in the security component.

Why it matters to the business

Unexpected database downtime that interrupts applications and services until the server is restarted, with low likelihood of exploitation but high operational cost during incidents.

How an attack unfolds

An attacker with existing high privileges and network access crafts specific protocol requests that abuse the privileges component to force the server into a hung or crashed state; no public exploitation or ransomware use has been observed.

How to fix it

Upgrade affected MySQL Server installations to versions later than 8.4.3 and 9.1.0; apply the corresponding Ubuntu package updates listed for linux-gcp-6.5, linux-lowlatency-hwe-6.5, and linux kernels where MySQL is deployed.

How to confirm the fix worked

Confirm MySQL version is newer than the affected releases, review release notes for the security fix, and perform controlled availability testing to verify the server no longer crashes under the previously triggering conditions.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL instance
2. Establish a connection using one of the supported protocols
3. Send crafted requests targeting the security/privileges component
4. Trigger repeated crashes or a persistent hang to achieve denial of service

How to detect it

Examine database error logs and system crash dumps for repeated abrupt terminations or hangs coinciding with privileged connection activity; correlate with network connection logs from high-privileged accounts.

What your security team should do

• Prioritize patching MySQL instances reachable over the network
• Review and reduce the number of high-privileged accounts with network access
• Monitor for availability alerts on database servers
• Test failover and restart procedures in staging environments