CVE-2025-21574

What it actually does

The flaw in the Server: Parser component allows a low-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the MySQL Server.

Why it matters to the business

Causes database service outages that disrupt dependent applications and operations; requires prompt patching on affected MySQL versions with low but rising exploit probability.

How an attack unfolds

An attacker with low-privileged network access sends crafted requests via supported protocols to the parser component, triggering resource exhaustion or crash without needing authentication elevation.

How to fix it

Upgrade affected MySQL installations to fixed versions beyond 8.0.41, 8.4.4, or 9.2.0; for listed Ubuntu wget packages apply the exact fixes such as 1.17.1-1ubuntu1.5+esm1 on 16.04 LTS and 1.19.4-1ubuntu2.2+esm1 on 18.04 LTS.

How to confirm the fix worked

Verify MySQL version strings post-upgrade and confirm the parser no longer accepts inputs that previously caused crashes; test connectivity and stability under load.

Typical attack path

1. Obtain low-privileged network credentials or access
2. Connect to MySQL Server over supported protocols
3. Send specially crafted queries or packets targeting the parser
4. Induce repeated crashes or hangs to achieve denial of service

How to detect it

Review database logs for repeated connection or query errors leading to service restarts; check process monitoring for unexpected MySQL terminations.

What your security team should do

• Apply vendor patches immediately given the 562 days since publication and positive EPSS trend
• Restrict network access to MySQL instances to trusted sources only
• Monitor for availability anomalies on database servers
• Update inventory to confirm no remaining vulnerable MySQL deployments