CVE-2025-21584

What it actually does

The flaw in the DDL component of MySQL Server permits a high-privileged network attacker to trigger a hang or repeatable crash, resulting in complete denial of service.

Why it matters to the business

Database downtime can interrupt dependent applications and services, causing operational disruption; low EPSS and absence from KEV reduce immediate widespread risk but patching remains important given 562 days since publication.

How an attack unfolds

An attacker with high database privileges connects over the network using supported protocols and issues crafted DDL operations that exploit the server component, leading to repeated crashes without requiring user interaction.

How to fix it

Upgrade affected MySQL Server installations to versions beyond 8.0.41, 8.4.4, and 9.2.0; apply vendor patches promptly given the published date and EPSS trend.

How to confirm the fix worked

Verify MySQL version numbers post-upgrade and confirm the DDL component no longer permits the described crash conditions through controlled testing.

Typical attack path

1. Obtain high-privileged database credentials
2. Establish network connectivity to the MySQL instance
3. Issue malicious DDL statements via supported protocols
4. Trigger server hang or crash to achieve denial of service

How to detect it

Review database server logs and process monitoring for unexpected crashes or hangs following DDL operations; correlate with privileged account activity.

What your security team should do

• Prioritize patching MySQL Server instances to fixed versions
• Review and restrict high-privileged network access to the database
• Monitor for availability anomalies in MySQL deployments
• Track EPSS score changes for any increase in exploit likelihood