CVE-2025-21491: Oracle MySQL Server InnoDB DOS Vulnerability

CVE-2025-21491 Overview

CVE-2025-21491 is a denial of service vulnerability in the InnoDB storage engine of Oracle MySQL Server. Oracle disclosed the flaw in the January 2025 Critical Patch Update. Affected versions include MySQL Server 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior. An authenticated attacker with high privileges and network access can trigger a hang or repeatable crash, resulting in a complete denial of service of the database server. The vulnerability is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling) and requires no user interaction. Successful exploitation impacts availability only, with no confidentiality or integrity effects.

Critical Impact
An authenticated high-privileged attacker can crash or hang the MySQL Server over the network, producing a complete database outage.

Affected Products

Oracle MySQL Server 8.0.40 and prior
Oracle MySQL Server 8.4.3 and prior
Oracle MySQL Server 9.1.0 and prior

Discovery Timeline

2025-01-21 - CVE-2025-21491 published to the National Vulnerability Database
2025-01-21 - Oracle releases fix in the January 2025 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21491

Vulnerability Analysis

The vulnerability resides in the InnoDB storage engine, which handles transactional storage, row-level locking, and crash recovery in MySQL Server. An attacker with high privileges on the database can send specially crafted requests over supported MySQL network protocols. These requests cause InnoDB to enter an unrecoverable state, hanging the server process or triggering a repeatable crash.

The flaw maps to [CWE-770], indicating that InnoDB fails to properly limit or throttle a resource consumed during request processing. Because the crash is repeatable, an attacker can defeat automatic restart mechanisms by resubmitting the trigger after service recovery. The vulnerability affects availability only; no data disclosure or modification occurs.

Root Cause

Oracle has not published low-level technical details for CVE-2025-21491. Based on the CWE-770 classification and InnoDB component scope, the defect involves unbounded resource consumption or an unhandled state within InnoDB request processing. Fix details are distributed only through the Oracle Critical Patch Update binaries.

Attack Vector

Exploitation requires network reachability to the MySQL Server listener and a valid account with high privileges. The attack traverses multiple supported MySQL protocols, meaning classic MySQL client connections and administrative protocol paths can both serve as delivery channels. No user interaction is required, and the attack complexity is low once credentials are held.

No public proof-of-concept is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

See the Oracle Critical Patch Update January 2025 advisory for technical details.

Detection Methods for CVE-2025-21491

Indicators of Compromise

Unexpected mysqld process crashes or hangs correlated with authenticated sessions from privileged accounts.
Repeated abnormal termination entries in the MySQL error log referencing InnoDB assertions or signal handlers.
Sudden spikes in InnoDB resource metrics (buffer pool, undo log, or thread counts) preceding server termination.

Detection Strategies

Monitor MySQL error logs for recurring InnoDB fatal errors, stack traces, or forced shutdowns tied to a specific client session.
Correlate authentication events for high-privilege accounts (users with SUPER, PROCESS, or administrative grants) against subsequent service failures.
Alert on repeated mysqld restarts within a short window, which suggests an attacker retriggering the crash after automatic recovery.

Monitoring Recommendations

Enable the MySQL general query log or audit plugin on sensitive instances to capture the statements executed by privileged sessions before a crash.
Ship MySQL error logs and audit events to a centralized SIEM or data lake for correlation with network and identity telemetry.
Track availability metrics for MySQL endpoints and generate alerts on unplanned downtime or connection failures.

How to Mitigate CVE-2025-21491

Immediate Actions Required

Apply the January 2025 Critical Patch Update for Oracle MySQL Server to all affected 8.0, 8.4, and 9.x instances.
Inventory MySQL deployments and identify any versions at or below 8.0.40, 8.4.3, or 9.1.0 for prioritized patching.
Review and reduce the population of accounts holding high privileges on production database servers.

Patch Information

Oracle addressed CVE-2025-21491 in the Oracle Critical Patch Update January 2025. NetApp published corresponding guidance for bundled MySQL components in NetApp Security Advisory NTAP-20250131-0004. Upgrade to MySQL Server 8.0.41, 8.4.4, 9.2.0, or later as applicable to the deployed branch.

Workarounds

Restrict network access to MySQL listeners using firewall rules or security groups so that only trusted application hosts and administrators can reach port 3306 and other MySQL protocol endpoints.
Enforce least privilege on database accounts and remove administrative grants from application users and shared service accounts.
Require strong authentication and rotate credentials for any account carrying SUPER, PROCESS, or SYSTEM_VARIABLES_ADMIN privileges until patching is complete.

bash

# Restrict MySQL access at the network layer and audit privileged accounts
# 1. Limit inbound access to trusted hosts only
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# 2. Identify accounts with high privileges for review
mysql -e "SELECT user, host FROM mysql.user \
  WHERE Super_priv='Y' OR Process_priv='Y';"