CVE-2025-21566

What it actually does

The flaw in the Optimizer component allows a low-privileged network attacker to trigger a hang or repeatable crash resulting in complete denial of service against the MySQL Server process.

Why it matters to the business

Successful exploitation can cause prolonged database downtime, interrupting dependent applications and services until the server is restarted.

How an attack unfolds

An attacker with low-privileged network access connects to the MySQL Server using supported protocols and submits specially crafted queries that abuse the optimizer logic, forcing the server into a hung or crashed state.

How to fix it

Apply the latest vendor patches for MySQL Server 9.1.0 and prior. For listed Ubuntu packages upgrade openvpn to the specified fixed versions: 2.3.2-7ubuntu3.2+esm1 on 14.04 LTS and 2.3.10-1ubuntu2.2+esm1 on 16.04 LTS.

How to confirm the fix worked

Confirm the MySQL Server version has been updated beyond 9.1.0 and test that previously successful denial-of-service queries no longer cause crashes or hangs.

Typical attack path

1. Obtain low-privileged network credentials for the MySQL Server
2. Establish a connection using one of the allowed protocols
3. Submit crafted queries that exercise the vulnerable optimizer code path
4. Observe repeated server hang or crash confirming denial of service

How to detect it

Inspect database server logs for repeated abnormal terminations, optimizer-related error messages, or sudden process restarts around the time of suspected attacks; correlate with network connection logs from low-privileged accounts.

What your security team should do

• Prioritize patching MySQL Server instances within the next maintenance window due to network exploitability
• Review and restrict low-privileged accounts that have network access to the database
• Monitor for unexpected MySQL process restarts or availability alerts