Cloudanix VulnDB

CVE-2025-21503

None

CVSS

—

EPSS

1.1%

Published

Jan 21, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in MySQL lets certain trusted users with remote access crash the database server and stop services from working.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows a high-privileged network attacker to trigger a denial of service in the InnoDB storage engine, causing the MySQL Server to hang or crash repeatedly.

Why it matters to the business

Leads to unplanned database downtime, disrupting applications and services that rely on MySQL, potentially causing data unavailability for extended periods. The vulnerability affects widely deployed Ubuntu packages with fixes available since early 2025.

How an attack unfolds

An attacker with high privileges authenticates to the MySQL server over the network and sends crafted requests that exploit a flaw in InnoDB, resulting in a server crash or hang. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade affected MySQL 8.0 installations on Ubuntu 20.04 LTS and 22.04 LTS to version 8.0.37-0ubuntu0.20.04.3 or 8.0.37-0ubuntu0.22.04.3 as appropriate. Apply the exact fixed package versions listed for each distribution and restart the service.

How to confirm the fix worked

Confirm the installed MySQL package version matches or exceeds the listed fixed releases for the Ubuntu release in use, then verify server stability under normal workloads and network access controls.

Typical attack path

  1. Obtain high-privileged database credentials
  2. Establish network connection to MySQL server via supported protocols
  3. Execute malicious operations targeting the InnoDB component
  4. Trigger hang or repeatable crash to achieve denial of service

How to detect it

Review MySQL error logs and system process logs for repeated InnoDB crashes or hangs, and correlate with authentication events from high-privileged accounts around the time of availability issues.

What your security team should do

  • Apply the exact fixed Ubuntu package versions immediately given the 628 days since publication
  • Restrict high-privileged network access to MySQL instances
  • Test patched versions in non-production environments before rollout
  • Review database privilege assignments to minimize high-privileged accounts

The record

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 mecab 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-ipadic 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-ipadic-EUCJP 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-common 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-devel 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-errmsg 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-libs 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-server 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql-test 0 8.0.41-1.module_el8.10.0+3965+b415b607
AlmaLinux:9 mysql 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-common 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-devel 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-errmsg 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-libs 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-server 0 8.0.41-2.el9_5
AlmaLinux:9 mysql-test 0 8.0.41-2.el9_5
Rocky Linux:8 mecab 0 0:0.996-2.module+el8.10.0+1676+9b4b6e24
Rocky Linux:8 mecab-ipadic 0 0:2.7.0.20070801-17.module+el8.10.0+1937+28fbbc83
Rocky Linux:8 mysql 0 0:8.0.41-1.module+el8.10.0+1937+28fbbc83.0.1
Rocky Linux:9 mysql 0 0:8.0.41-2.el9_5
Ubuntu:14.04:LTS mysql-5.5 0 No fix
Ubuntu:16.04:LTS mariadb-10.0 0 No fix
Ubuntu:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:18.04:LTS mariadb-10.1 0 No fix
Ubuntu:20.04:LTS mariadb-10.3 0 No fix
Ubuntu:20.04:LTS mysql-8.0 0 No fix
Ubuntu:20.04:LTS mysql-8.0 0 8.0.41-0ubuntu0.20.04.1
Ubuntu:22.04:LTS mariadb-10.6 0 No fix
Ubuntu:22.04:LTS mysql-8.0 0 No fix
Ubuntu:22.04:LTS mysql-8.0 0 8.0.41-0ubuntu0.22.04.1
Ubuntu:24.04:LTS mariadb 0 No fix
Ubuntu:24.04:LTS mysql-8.0 0 No fix
Ubuntu:24.04:LTS mysql-8.0 0 8.0.41-0ubuntu0.24.04.1
Ubuntu:24.10 mariadb 0 No fix
Ubuntu:24.10 mysql-8.0 0 No fix
Ubuntu:25.04 mariadb 0 No fix
Ubuntu:25.10 mariadb 0 No fix
Ubuntu:Pro:14.04:LTS mysql-5.5 0 No fix
Ubuntu:Pro:16.04:LTS mariadb-10.0 0 No fix
Ubuntu:Pro:16.04:LTS mysql-5.7 0 No fix
Ubuntu:Pro:16.04:LTS percona-server-5.6 0 No fix
Ubuntu:Pro:16.04:LTS percona-xtradb-cluster-5.6 0 No fix
Ubuntu:Pro:18.04:LTS mariadb-10.1 0 No fix
Ubuntu:Pro:18.04:LTS mysql-5.7 0 No fix
Ubuntu:Pro:20.04:LTS mariadb-10.3 0 No fix

Related vulnerabilities