CVE-2025-21504

What it actually does

The vulnerability in the Optimizer component allows a high-privileged network attacker to trigger a hang or frequently repeatable crash resulting in complete denial of service to MySQL Server.

Why it matters to the business

Database availability is disrupted causing application downtime and operational interruption until the affected MySQL instance is restarted or recovered.

How an attack unfolds

An attacker possessing high database privileges connects over the network using supported protocols and submits specially crafted queries that exploit weaknesses in the optimizer logic to induce a crash or hang state.

How to fix it

Upgrade MySQL Server to fixed versions beyond 8.0.39, 8.4.2, and 9.0.1 respectively; apply the latest vendor patches for the supported release trains.

How to confirm the fix worked

Confirm the running MySQL version is newer than the affected releases and test that optimizer-related queries no longer cause crashes under equivalent privilege levels.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connectivity to the MySQL server
3. Issue crafted queries targeting optimizer paths
4. Trigger repeated crash or hang condition

How to detect it

Review MySQL error logs and process crash dumps for optimizer-related faults; correlate with authentication events from high-privileged accounts around the time of service restarts.

What your security team should do

• Apply the appropriate MySQL patch immediately given the public disclosure
• Restrict network access to database ports to trusted sources only
• Review and minimize the number of high-privileged accounts
• Monitor database logs for unexpected restarts or optimizer errors