CVE-2025-21521

What it actually does

Unauthenticated network attacker can trigger a hang or repeatable crash (complete DoS) in the Thread Pooling component of MySQL Server over multiple protocols.

Why it matters to the business

Leads to extended database downtime and service unavailability for organizations using affected MySQL versions on Ubuntu systems; low but stable EPSS and 628 days since publication indicate persistent exposure risk across many deployments.

How an attack unfolds

Attacker sends crafted network requests via supported protocols to the MySQL Server Thread Pooling component; successful exploitation requires no authentication and directly causes the server process to hang or crash repeatedly.

How to fix it

Upgrade ruby-rack on Ubuntu 24.04 LTS to 2.2.7-1ubuntu0.1 and on Ubuntu 23.10 to 2.2.4-3ubuntu0.2; apply Oracle MySQL patches for 8.0.39+, 8.4.2+, and 9.0.1+ as soon as available.

How to confirm the fix worked

Verify package versions match the listed fixed releases using apt or dpkg; confirm MySQL Server no longer accepts the crashing inputs after upgrade and test availability under load.

Typical attack path

1. Identify exposed MySQL Server instances on the network
2. Send unauthenticated requests targeting the Thread Pooling component
3. Trigger repeated crashes or hangs to achieve denial of service

How to detect it

Review MySQL error logs and thread pool activity for repeated crash or hang events; inspect network logs for unusual unauthenticated connection patterns to the database ports.

What your security team should do

• Prioritize patching affected Ubuntu ruby-rack and MySQL packages within the next maintenance window
• Restrict network access to MySQL ports to trusted sources until patched
• Monitor EPSS trend and threat actor activity for any increase in exploitation attempts