CVE-2025-21518

What it actually does

Flaw in the MySQL Server Optimizer component permits a low-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Database servers become unavailable, causing application downtime, interrupted services, and potential loss of revenue or productivity for organizations relying on affected MySQL versions.

How an attack unfolds

An attacker with low privileges connects to the MySQL Server over supported network protocols and submits specially crafted queries that exploit the Optimizer component, leading to a server hang or crash without requiring authentication escalation.

How to fix it

Upgrade MySQL Server to versions later than 8.0.40, 8.4.3, and 9.1.0 as provided in Oracle's security updates; apply patches promptly given the ease of exploitation.

How to confirm the fix worked

Verify server version after upgrade, test connectivity and query handling under load to confirm stability, and review Oracle release notes for the specific fixed builds.

Typical attack path

1. Obtain low-privileged network access to a vulnerable MySQL instance
2. Connect using any supported protocol
3. Issue crafted queries targeting the Optimizer
4. Trigger repeated crashes or hangs to sustain denial of service

How to detect it

Review database logs for repeated crashes, abnormal optimizer-related errors, or sudden connection terminations around the time of suspected activity; correlate with network logs showing connections from untrusted sources.

What your security team should do

• Prioritize patching all internet-facing and internal MySQL instances within the next maintenance window
• Restrict network access to database ports using firewalls or allow-lists
• Monitor for unusual query patterns or repeated connection attempts that could indicate testing for the flaw
• Review and enforce least-privilege database accounts