CVE-2025-21497

What it actually does

High-privileged network attacker can trigger InnoDB component flaws to cause repeated server crashes or hangs while also performing unauthorized data modifications via update/insert/delete operations.

Why it matters to the business

Database downtime disrupts operations and availability while allowing limited unauthorized changes to stored data, increasing risk of data integrity issues in production environments.

How an attack unfolds

An attacker with high database privileges connects over the network using supported protocols and submits specially crafted queries or commands that exploit weaknesses in the InnoDB storage engine, resulting in denial of service and partial data manipulation without requiring additional authentication bypass.

How to fix it

Upgrade affected MySQL Server installations to fixed versions beyond 8.0.40, 8.4.3, and 9.1.0; for the listed Ubuntu package apply linux-oem-6.5 updates to 6.5.0-1024.25 or later.

How to confirm the fix worked

Verify MySQL Server version reports above the affected thresholds, test connectivity and query handling under load to confirm stability, and review changelog entries for InnoDB fixes.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connection to MySQL Server using multiple protocols
3. Submit crafted InnoDB-related queries or operations
4. Trigger hang/crash combined with unauthorized data modifications

How to detect it

Monitor database logs for repeated InnoDB crash or hang events, unusual privilege usage patterns on network connections, and unexpected data modification timestamps from high-privileged accounts.

What your security team should do

• Prioritize patching MySQL Server instances to fixed releases
• Restrict high-privileged accounts to trusted networks only
• Enable monitoring for unexpected InnoDB crashes or data anomalies
• Review and minimize network exposure of database ports