Cloudanix VulnDB

CVE-2025-21499

None

CVSS

—

EPSS

1.0%

Published

Jan 21, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the database server lets a trusted user with special access crash the whole system, taking applications offline until it is restarted.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in the MySQL Server DDL component, resulting in complete denial of service.

Why it matters to the business

Database instances become unavailable, interrupting applications and services that depend on them and requiring manual restarts or failover.

How an attack unfolds

An attacker with high privileges and network access authenticates to the MySQL Server and issues crafted DDL statements that exploit the vulnerable code path, causing the server process to hang or crash.

How to fix it

Upgrade affected MySQL Server installations to fixed versions; for linux-aws-5.15 on Ubuntu 20.04 LTS apply package version 5.15.0-1063.69~20.04.1 or later.

How to confirm the fix worked

Verify the running MySQL Server version and package revision against the listed fixed versions; test that previously crashing DDL operations no longer cause hangs or crashes.

Typical attack path

  1. Obtain high-privileged database credentials with network access
  2. Connect to the MySQL Server using supported protocols
  3. Issue malicious DDL commands targeting the vulnerable component
  4. Observe server hang or crash leading to denial of service

How to detect it

Review MySQL error logs and system crash dumps for repeated DDL-related failures or abrupt server terminations around the time of reported outages.

What your security team should do

  • Apply the listed fixed package versions immediately on all affected Ubuntu systems
  • Restrict high-privileged database accounts to trusted networks only
  • Monitor for unusual DDL activity from privileged users
  • Review and reduce the number of high-privileged accounts

The record

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS mysql-5.5 0 No fix
Ubuntu:16.04:LTS mariadb-10.0 0 No fix
Ubuntu:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:18.04:LTS mariadb-10.1 0 No fix
Ubuntu:20.04:LTS mariadb-10.3 0 No fix
Ubuntu:22.04:LTS mariadb-10.6 0 No fix
Ubuntu:24.04:LTS mariadb 0 No fix
Ubuntu:24.10 mariadb 0 No fix
Ubuntu:25.04 mariadb 0 No fix
Ubuntu:25.10 mariadb 0 No fix
Ubuntu:Pro:14.04:LTS mysql-5.5 0 No fix
Ubuntu:Pro:16.04:LTS mariadb-10.0 0 No fix
Ubuntu:Pro:16.04:LTS mysql-5.7 0 No fix
Ubuntu:Pro:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:Pro:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:Pro:18.04:LTS mariadb-10.1 0 No fix
Ubuntu:Pro:18.04:LTS mysql-5.7 0 No fix
Ubuntu:Pro:20.04:LTS mariadb-10.3 0 No fix

Related vulnerabilities