Cloudanix VulnDB

CVE-2025-21577

None

CVSS

—

EPSS

0.8%

Published

Apr 15, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw lets someone with limited access crash the database server over the network, stopping work for any applications that rely on it.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability in the InnoDB component allows a low-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service for the MySQL Server.

Why it matters to the business

Database downtime disrupts dependent applications and services, leading to operational interruptions; with 562 days since publication and a slight EPSS upward trend, unpatched instances carry ongoing availability risk even without confirmed KEV usage.

How an attack unfolds

An attacker with low privileges obtains network access via supported protocols and sends specially crafted requests to the InnoDB component, causing the MySQL Server to hang or crash repeatedly.

How to fix it

Upgrade MySQL Server to versions beyond 8.0.41, 8.4.4 and 9.2.0; apply the latest stable releases from Oracle and verify no mismatched component updates (such as openssl) are required for your environment.

How to confirm the fix worked

Confirm the running MySQL version is newer than the affected ranges, review release notes for the InnoDB fix, and perform stability testing under simulated load to ensure crashes no longer occur.

Typical attack path

  1. Obtain low-privileged network access to a vulnerable MySQL instance
  2. Identify affected version in 8.0.0-8.0.41, 8.4.0-8.4.4 or 9.0.0-9.2.0 range
  3. Send crafted requests over multiple protocols to InnoDB
  4. Trigger hang or crash to achieve denial of service

How to detect it

Review MySQL error logs and system crash dumps for repeated InnoDB-related terminations, examine connection and query logs for patterns from low-privileged accounts, and correlate with network traffic on database ports around crash timestamps.

What your security team should do

  • Prioritize patching all MySQL 8.0/8.4/9.0 instances to fixed versions
  • Restrict network exposure of database ports to trusted sources only
  • Monitor EPSS trend and threat intelligence for any increase in exploitation activity
  • Implement connection rate limiting and account privilege reviews as interim controls

The record

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:10 mysql-selinux 0 1.0.14-1.el10_0
AlmaLinux:10 mysql8.4 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-common 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-devel 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-errmsg 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-libs 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-server 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-test 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-test-data 0 8.4.6-2.el10_0
AlmaLinux:8 mecab 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-ipadic 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-ipadic-EUCJP 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-common 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-devel 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-errmsg 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-libs 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-server 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-test 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:9 mecab 0 0.996-3.module_el9.6.0+152+8cbce00c.4
AlmaLinux:9 mecab-devel 0 0.996-3.module_el9.6.0+152+8cbce00c.4
AlmaLinux:9 mecab-ipadic 0 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
AlmaLinux:9 mecab-ipadic-EUCJP 0 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
AlmaLinux:9 mysql 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-common 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-common 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-devel 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-devel 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-errmsg 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-errmsg 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-libs 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-libs 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-server 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-server 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-test 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-test 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-test-data 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 rapidjson-devel 0 1.1.0-19.module_el9.6.0+152+8cbce00c
AlmaLinux:9 rapidjson-doc 0 1.1.0-19.module_el9.6.0+152+8cbce00c

Related vulnerabilities