Cloudanix VulnDB

CVE-2025-30699

None

CVSS

—

EPSS

0.9%

Published

Apr 15, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in MySQL lets someone with strong login rights crash the database server over the network, stopping applications that rely on it until the server is restarted.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

High-privileged network attacker can trigger a hang or repeatable crash in the Server: Stored Procedure component of MySQL Server, resulting in complete denial of service.

Why it matters to the business

Database instances become unavailable, interrupting dependent applications, analytics workloads, and business operations until the service is restarted or recovered.

How an attack unfolds

An attacker with high-privileged network credentials authenticates to an affected MySQL instance and issues crafted stored-procedure operations that trigger the flaw, causing the server process to hang or crash.

How to fix it

Upgrade affected MySQL installations to a fixed version; for linux-aws-5.15 on Ubuntu 20.04 LTS apply package version 5.15.0-1070.76~20.04.1 or later. Verify the upgrade removes the vulnerable stored-procedure handling code.

How to confirm the fix worked

Confirm the running MySQL version reports a fixed release, test stored-procedure operations that previously triggered the crash, and monitor for absence of the hang/crash behavior under load.

Typical attack path

  1. Obtain high-privileged network credentials for the MySQL instance
  2. Connect via supported protocols to the target MySQL Server
  3. Execute stored-procedure statements that exercise the vulnerable code path
  4. Observe service hang or crash and repeat to maintain denial of service

How to detect it

Review MySQL error logs and process crash dumps for repeated stored-procedure related failures or abrupt terminations around the time of reported outages; correlate with authentication events from privileged accounts.

What your security team should do

  • Prioritize patching all listed MySQL versions because the vulnerability has been public for over a year and EPSS shows a modest upward trend
  • Apply the exact fixed package 5.15.0-1070.76~20.04.1 on Ubuntu 20.04 LTS systems first
  • Restrict network access to MySQL ports to only trusted management hosts
  • Review and reduce the number of high-privileged accounts with network access

The record

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:10 mysql-selinux 0 1.0.14-1.el10_0
AlmaLinux:10 mysql8.4 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-common 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-devel 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-errmsg 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-libs 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-server 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-test 0 8.4.6-2.el10_0
AlmaLinux:10 mysql8.4-test-data 0 8.4.6-2.el10_0
AlmaLinux:8 mecab 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-devel 0 0.996-2.module_el8.6.0+3340+d764b636
AlmaLinux:8 mecab-ipadic 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mecab-ipadic-EUCJP 0 2.7.0.20070801-17.module_el8.10.0+3965+b415b607
AlmaLinux:8 mysql 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-common 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-devel 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-errmsg 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-libs 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-server 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:8 mysql-test 0 8.0.43-1.module_el8.10.0+4049+06e4dcce
AlmaLinux:9 mecab 0 0.996-3.module_el9.6.0+152+8cbce00c.4
AlmaLinux:9 mecab-devel 0 0.996-3.module_el9.6.0+152+8cbce00c.4
AlmaLinux:9 mecab-ipadic 0 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
AlmaLinux:9 mecab-ipadic-EUCJP 0 2.7.0.20070801-24.module_el9.6.0+152+8cbce00c
AlmaLinux:9 mysql 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-common 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-common 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-devel 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-devel 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-errmsg 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-errmsg 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-libs 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-libs 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-server 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-server 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-test 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 mysql-test 0 8.0.43-1.el9_6
AlmaLinux:9 mysql-test-data 0 8.4.6-1.module_el9.6.0+180+a4e757e5
AlmaLinux:9 rapidjson-devel 0 1.1.0-19.module_el9.6.0+152+8cbce00c
AlmaLinux:9 rapidjson-doc 0 1.1.0-19.module_el9.6.0+152+8cbce00c

Related vulnerabilities