CVE-2025-21501

What it actually does

Low-privileged network attacker can trigger a hang or repeatable crash in the MySQL Server Optimizer component, resulting in complete denial of service for the database process.

Why it matters to the business

Database services become unavailable, causing application downtime, interrupted transactions, and operational disruption until the server is restarted; urgency is low given absence from KEV and stable low EPSS.

How an attack unfolds

An attacker with valid low-privileged database credentials connects over supported network protocols and submits specially crafted queries that exercise the Optimizer, causing the MySQL server to hang or crash.

How to fix it

Upgrade affected MySQL installations to versions beyond 8.0.40, 8.4.3, or 9.1.0; for linux-azure on Ubuntu 22.04 LTS apply kernel package 5.15.0-1066.75 or later.

How to confirm the fix worked

Confirm MySQL version is newer than the listed affected releases and that linux-azure kernel package meets or exceeds 5.15.0-1066.75; test that crafted optimizer queries no longer cause crashes.

Typical attack path

1. Obtain low-privileged network access to a vulnerable MySQL instance
2. Authenticate using valid low-privileged credentials
3. Issue crafted queries targeting the Optimizer component
4. Trigger repeated crashes or hangs leading to denial of service

How to detect it

Review database error logs and crash dumps for optimizer-related failures; correlate with connection logs from low-privileged accounts showing unusual query patterns; no known public exploitation artifacts exist given exploit maturity of None.

What your security team should do

• Apply the listed fixed package versions immediately on all affected systems
• Restrict network access to MySQL ports to trusted sources only
• Monitor for availability alerts on database instances
• Review and minimize low-privileged accounts with network access