CVE-2025-30704

What it actually does

The vulnerability in the Server: Components Services component allows a high-privileged network attacker to trigger a hang or repeatable crash resulting in complete denial of service against MySQL Server.

Why it matters to the business

Successful exploitation causes unplanned database downtime that interrupts dependent applications and services, with potential for repeated outages until the server is restarted.

How an attack unfolds

An attacker who already possesses high privileges connects to a vulnerable MySQL Server instance over the network and sends specially crafted requests through multiple protocols to the Components Services layer, inducing a hang or crash. No public exploits or named threat actors are known.

How to fix it

Upgrade affected MySQL Server installations to patched releases beyond 8.0.41, 8.4.4, and 9.2.0. Restrict network exposure of database instances and minimize the number of high-privileged accounts with remote access.

How to confirm the fix worked

Confirm the installed MySQL version is newer than the affected ranges listed in the Oracle advisory; test service stability under load after patching; review error and crash logs for absence of previously observed hangs.

Typical attack path

1. Obtain high-privileged network credentials for the MySQL Server
2. Establish a connection via supported protocols to the target instance
3. Send crafted requests targeting the Components Services component
4. Trigger a hang or repeatable crash that results in denial of service

How to detect it

Inspect MySQL error logs and crash reports for repeated hangs or abrupt terminations following privileged network connections; correlate service restart events with authentication activity from administrative accounts.

What your security team should do

• Apply the latest MySQL Server patches to eliminate the denial-of-service condition
• Reduce the attack surface by limiting network access and high-privileged remote accounts
• Monitor database availability metrics and automate restart procedures for rapid recovery
• Review privileged account usage and enforce least-privilege principles