CVE-2025-21519

What it actually does

High-privileged network attacker can trigger a flaw in MySQL Server's privilege handling to cause a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Database downtime can interrupt dependent applications and services, leading to operational disruption; low EPSS and absence from KEV reduce immediate widespread risk but patching remains necessary for affected MySQL deployments.

How an attack unfolds

An attacker with high privileges connects to the MySQL Server over supported protocols and issues crafted requests targeting the privileges component to induce a crash or hang; no public exploits or named threat actors are associated.

How to fix it

Upgrade affected MySQL installations to versions beyond 8.0.40, 8.4.3, or 9.1.0; for the listed linux-intel-iotg-5.15 package on Ubuntu 20.04 LTS apply the fixed kernel version 5.15.0-1058.64~20.04.1 or later.

How to confirm the fix worked

Verify MySQL version is no longer in the affected range, test connectivity and stability after upgrade, and confirm absence of crash reproduction under privileged network operations.

Typical attack path

1. Obtain high-privileged MySQL account with network access
2. Connect to the server using multiple protocols
3. Submit malicious privilege-related commands or queries
4. Trigger hang or repeatable crash denying service to other users

How to detect it

Review MySQL error logs and system crash reports for repeated privilege-related failures or abrupt terminations; correlate with network connection attempts from high-privileged accounts.

What your security team should do

• Apply the listed fixed package versions promptly to eliminate exposure
• Restrict network access to MySQL instances to only trusted high-privileged clients
• Monitor database availability metrics for unexpected hangs or crashes
• Review privilege assignments to ensure least-privilege principles