CVE-2025-21536

What it actually does

The flaw in the Server: Optimizer component permits a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the MySQL Server process.

Why it matters to the business

Leads to extended database downtime and operational disruption for dependent services; the 628 days since publication increases urgency for remediation across affected deployments despite low EPSS.

How an attack unfolds

A high-privileged attacker with network access connects to the MySQL Server via supported protocols and submits specially crafted requests that abuse the optimizer logic, forcing the server into a hung or crashed state without needing additional authentication bypasses.

How to fix it

Upgrade MySQL Server to fixed versions beyond 8.0.39, 8.4.2, and 9.0.1; apply the listed php7.0 (Ubuntu:Pro:16.04:LTS) update to 7.0.33-0ubuntu0.16.04.16+esm11 where applicable.

How to confirm the fix worked

Confirm server version reports a fixed release, re-execute representative optimizer workloads to verify absence of crashes, and review changelog entries for the optimizer component.

Typical attack path

1. Obtain high-privileged MySQL account credentials
2. Establish network connection using multiple protocols
3. Submit crafted optimizer-triggering queries or commands
4. Induce hang or crash to achieve denial of service

How to detect it

Review MySQL error logs and process crash dumps for optimizer-related failures; monitor for repeated high-privileged connections followed by abrupt terminations.

What your security team should do

• Prioritize patching within maintenance windows given the long publication window
• Restrict high-privileged network access via firewall rules and VPN
• Enable enhanced logging for optimizer-related operations
• Test failover and recovery procedures for database availability