CVE-2024-21090: MySQL Connector/Python DoS Vulnerability

CVE-2024-21090 Overview

CVE-2024-21090 is a Denial of Service (DoS) vulnerability in the MySQL Connectors product of Oracle MySQL, specifically affecting the Connector/Python component. This easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors, resulting in unauthorized ability to cause a hang or frequently repeatable crash of the affected component.

Critical Impact

Successful exploitation enables complete Denial of Service (DoS) against MySQL Connector/Python, potentially disrupting all database connectivity for applications relying on this component.

Affected Products

• Oracle MySQL Connector/Python version 8.3.0 and prior

Discovery Timeline

• April 16, 2024 - CVE-2024-21090 published to NVD
• May 13, 2025 - Last updated in NVD database

Technical Details for CVE-2024-21090

Vulnerability Analysis

This vulnerability affects the Oracle MySQL Connector/Python, a driver that enables Python applications to communicate with MySQL databases. The flaw allows remote attackers to cause a complete denial of service condition without requiring any authentication or user interaction.

The vulnerability is network-accessible and can be triggered through multiple protocols, making it particularly dangerous in environments where MySQL Connector/Python is exposed to untrusted network segments. Successful exploitation results in either a hang condition or a frequently repeatable crash of the connector, completely disrupting database operations for applications dependent on this component.

The impact is limited to availability; there is no evidence of confidentiality or integrity compromise. However, for applications with strict uptime requirements, this vulnerability represents a significant operational risk.

Root Cause

The exact root cause has not been publicly disclosed by Oracle. Based on the vulnerability characteristics—an unauthenticated network-accessible attack that causes hangs or crashes—this appears to be related to improper handling of network input that leads to resource exhaustion or unhandled exception conditions within the Connector/Python component.

Attack Vector

The attack can be launched remotely over the network without requiring authentication or user interaction. An attacker with network access to a system running a vulnerable version of MySQL Connector/Python can send specially crafted requests via multiple protocols to trigger the denial of service condition. The attack is highly repeatable, allowing an attacker to maintain a persistent DoS state against the target application.

Detection Methods for CVE-2024-21090

Indicators of Compromise

• Unexpected crashes or hangs of Python applications utilizing MySQL Connector/Python
• Repeated connection failures to MySQL databases from Python-based applications
• Unusual network traffic patterns targeting Python application endpoints
• Application log entries showing unhandled exceptions in mysql.connector modules

Detection Strategies

• Monitor Python application processes for unexpected termination or unresponsive states
• Implement application-level health checks that verify database connectivity through MySQL Connector/Python
• Deploy network intrusion detection rules to identify anomalous traffic patterns targeting database connector endpoints
• Review application logs for recurring patterns of MySQL connection failures or timeouts

Monitoring Recommendations

• Configure alerting for Python application process crashes involving MySQL Connector modules
• Establish baseline metrics for database connection success rates and monitor for anomalies
• Implement real-time monitoring of application availability and response times
• Set up log aggregation to correlate MySQL Connector errors across distributed application instances

How to Mitigate CVE-2024-21090

Immediate Actions Required

• Upgrade MySQL Connector/Python to a patched version as specified in Oracle's Critical Patch Update
• Review network segmentation to limit exposure of applications using MySQL Connector/Python
• Implement rate limiting and connection throttling at the network layer
• Consider deploying application-level monitoring to detect and respond to DoS conditions

Patch Information

Oracle has addressed this vulnerability in the April 2024 Critical Patch Update. Organizations should apply the relevant patch as soon as possible. Refer to the Oracle Critical Patch Update April 2024 for detailed patching instructions and updated versions.

Workarounds

• Restrict network access to applications using MySQL Connector/Python to trusted sources only
• Implement connection pooling with appropriate timeouts to limit the impact of individual connection failures
• Deploy application-level load balancing to distribute requests and minimize single-point-of-failure risk
• Configure automatic service restart policies to recover from crash conditions quickly