CVE-2025-21555

What it actually does

The vulnerability in the InnoDB component permits a high-privileged attacker with network access to induce a denial of service through repeated crashes or hangs and to perform unauthorized modifications to accessible data.

Why it matters to the business

Leads to service disruptions from database unavailability and potential data corruption issues impacting operations across 4 downstream dependents.

How an attack unfolds

An attacker with high privileges connects via network protocols and leverages the flaw in InnoDB to trigger crashes and modify data without further authentication beyond privileges.

How to fix it

Upgrade MySQL Server beyond the affected versions 8.0.40 8.4.3 and 9.1.0; apply ansible package fixes including 2.0.0.2-2ubuntu1.3+esm2 for Ubuntu Pro 16.04 LTS 2.5.1+dfsg-1ubuntu0.1+esm2 for 18.04 LTS 2.9.6+dfsg-1ubuntu0.1~esm2 for 20.04 LTS and 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4 for 22.04 LTS.

How to confirm the fix worked

Confirm MySQL versions exceed 8.0.40 8.4.3 and 9.1.0 and verify ansible packages match the listed fixed versions on affected Ubuntu systems.

Typical attack path

1. Obtain high privileged network access to the MySQL server
2. Connect to the server using multiple supported protocols
3. Trigger the InnoDB flaw to cause a hang or repeatable crash
4. Perform unauthorized update insert or delete operations on accessible data

How to detect it

Review MySQL error logs for repeated InnoDB crashes or hangs and audit privileged user activity for unexpected data modifications.

What your security team should do

• Apply MySQL upgrades immediately given the published date and stable EPSS
• Update ansible packages to the specified fixed versions on Ubuntu Pro systems
• Restrict high privileged network access to MySQL instances
• Monitor database availability and data modification logs for anomalies