CVE-2025-21585

What it actually does

Allows a high-privileged network attacker to trigger a hang or repeatable crash in the MySQL Server optimizer component, resulting in complete denial of service.

Why it matters to the business

Database services can be taken offline or made unavailable, interrupting dependent applications and causing operational downtime; low exploit probability but high urgency if targeted by privileged insiders.

How an attack unfolds

An attacker with high privileges and network access connects to the MySQL server using supported protocols and sends specially crafted optimizer-related requests that cause the server process to hang or crash repeatedly.

How to fix it

Upgrade affected MySQL installations to versions beyond 8.0.41, 8.4.4, and 9.2.0 respectively; apply the corresponding fixed packages listed for each distribution and restart the service.

How to confirm the fix worked

Verify the installed MySQL version is newer than the affected ranges; confirm the service remains stable under load after upgrade and review release notes for the optimizer fix.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL server
2. Establish a connection via multiple protocols
3. Submit malicious optimizer queries or operations
4. Trigger repeated server hang or crash resulting in DoS

How to detect it

Inspect database logs and process monitors for repeated optimizer-related crashes or hangs; correlate with privileged login events from network sources.

What your security team should do

• Prioritize patching MySQL servers with high-privileged network access within the next maintenance window
• Review and reduce unnecessary high-privileged accounts with network access
• Monitor EPSS trend for any increase and reassess if new exploits appear