CVE-2025-21575

What it actually does

Improper input validation in the server parser component allows a low-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Database services can be disrupted causing application downtime and loss of availability for dependent systems; the issue affects widely used database deployments with moderate exploit likelihood indicated by EPSS trend.

How an attack unfolds

An attacker with low-privileged network access authenticates and sends specially crafted input through supported protocols to the parser; successful exploitation causes the server to hang or crash without requiring user interaction.

How to fix it

Upgrade affected packages to the listed fixed versions including ruby2.7 (Ubuntu:20.04:LTS) to 2.7.0-5ubuntu1.14 and ruby3.0 (Ubuntu:22.04:LTS) to 3.0.2-7ubuntu2.7; apply vendor patches for MySQL Server versions beyond 8.0.41, 8.4.4, and 9.2.0.

How to confirm the fix worked

Verify package versions match the fixed releases, test connectivity and parser operations under load, and confirm no crash occurs with previously triggering inputs.

Typical attack path

1. Obtain low-privileged credentials
2. Establish network connection via supported protocols
3. Submit crafted input targeting the parser
4. Induce hang or crash to achieve denial of service

How to detect it

Review database server logs for repeated connection attempts followed by unexpected crashes or hangs; correlate with network protocol traffic from low-privileged accounts.

What your security team should do

• Prioritize patching within normal change windows given absence from KEV
• Monitor EPSS score trajectory for any increase
• Review database access controls to limit low-privileged network exposure