CVE-2025-21559

What it actually does

The flaw in the InnoDB component permits a high-privileged network attacker to trigger a hang or repeatable crash (complete DoS) while also enabling unauthorized insert, update, or delete operations on accessible data.

Why it matters to the business

Service outages and partial data integrity loss can interrupt database-dependent operations, increasing downtime and requiring recovery effort; low ecosystem prevalence limits widespread downstream impact.

How an attack unfolds

An authenticated high-privileged attacker connects to the MySQL Server over supported network protocols and submits crafted requests that exploit the InnoDB vulnerability, resulting in a crash or data modification without further authentication bypass.

How to fix it

Upgrade affected MySQL Server installations (8.0.40 and prior, 8.4.3 and prior, 9.1.0 and prior) to the latest patched releases provided by Oracle; restrict unnecessary network exposure for privileged accounts until patches are applied.

How to confirm the fix worked

Confirm MySQL version is updated beyond listed affected releases, review release notes for the fix, and test that previously reproducible crash or data-modification sequences no longer succeed.

Typical attack path

1. Obtain high-privileged network credentials
2. Establish connection via multiple protocols
3. Submit malicious requests targeting InnoDB
4. Induce hang, crash, or unauthorized data changes

How to detect it

Inspect MySQL error logs and crash reports for repeated InnoDB-related failures or hangs; correlate with privileged network connection events around the time of incidents.

What your security team should do

• Apply Oracle-supplied patches at the earliest maintenance window given the published date and steady EPSS
• Limit network access and enforce least-privilege accounts for MySQL administration
• Monitor database logs and process health for unexplained crashes