CVE-2025-21523

What it actually does

The flaw in the InnoDB component allows a high-privileged network attacker to trigger a hang or crash, resulting in denial of service for MySQL Server.

Why it matters to the business

Disrupts database availability leading to operational downtime; published over 600 days ago with low unchanging EPSS and no KEV or ransomware usage indicates limited broad risk but still requires patching on affected Ubuntu Ruby packages.

How an attack unfolds

An attacker with high privileges authenticates to the MySQL server over network protocols and sends specially crafted requests to exploit the InnoDB issue, causing the server process to hang or repeatedly crash.

How to fix it

Upgrade ruby2.7 on Ubuntu 20.04 LTS to 2.7.0-5ubuntu1.13 and ruby3.0 on Ubuntu 22.04 LTS to 3.0.2-7ubuntu2.6; apply vendor patches for MySQL Server versions beyond 8.0.40, 8.4.3, and 9.1.0.

How to confirm the fix worked

Verify package versions match the listed fixed releases on Ubuntu systems and confirm MySQL Server instances are updated past the affected versions; test for absence of the described hang/crash behavior under load.

Typical attack path

1. Obtain high-privileged network credentials for MySQL
2. Establish connection via supported protocols
3. Transmit malicious InnoDB-targeted requests
4. Trigger server hang or complete denial of service

How to detect it

Review MySQL error and crash logs for repeated InnoDB-related hangs around high-privileged session activity; correlate with authentication events from network sources.

What your security team should do

• Prioritize upgrading listed Ruby packages to the exact fixed versions provided
• Review and restrict high-privileged network access to database servers
• Monitor EPSS and KEV updates for any change in exploit likelihood