CVE-2025-21492: Oracle MySQL Server DOS Vulnerability

CVE-2025-21492 Overview

CVE-2025-21492 is a denial of service vulnerability in the Oracle MySQL Server Optimizer component. Affected versions include MySQL Server 8.0.36 and prior, as well as 8.4.0. A high-privileged attacker with network access via multiple protocols can trigger a hang or repeatable crash, resulting in a complete denial of service of the database engine. The flaw is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. Downstream products from NetApp that embed or depend on MySQL, including Active IQ Unified Manager, OnCommand Insight, and OnCommand Workflow Automation, are also impacted.

Critical Impact
Successful exploitation causes a complete denial of service of the MySQL Server process, disrupting all dependent applications and services.

Affected Products

Oracle MySQL Server 8.0.36 and prior
Oracle MySQL Server 8.4.0
NetApp Active IQ Unified Manager (VMware vSphere and Windows), OnCommand Insight, and OnCommand Workflow Automation

Discovery Timeline

2025-01-21 - CVE CVE-2025-21492 published to NVD
2025-01-21 - Oracle releases fix in the January 2025 Critical Patch Update
2025-01-24 - NetApp publishes downstream advisory NTAP-20250124-0011
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21492

Vulnerability Analysis

The vulnerability resides in the MySQL Server query Optimizer, the subsystem responsible for parsing SQL statements and producing execution plans. An authenticated attacker with high privileges can issue a crafted query that causes the optimizer to consume resources without bound or enter a state that leads to a server hang or crash. Because the impact scope is limited to availability, the vulnerability does not leak data or allow modification, but it halts all database processing until the service is restarted.

Exploitation is repeatable, meaning a single attacker session can trigger the fault on demand. Any application that shares a MySQL instance with an attacker-controlled account is therefore exposed to sustained outages. Downstream software from NetApp that bundles MySQL for its management databases inherits the same exposure.

Root Cause

The issue maps to CWE-770, which describes the allocation of resources without proper limits or throttling. The optimizer fails to constrain the work performed while processing certain query shapes, allowing an authenticated user to force the server into an unrecoverable state. Oracle has not published detailed root-cause information beyond the advisory summary.

Attack Vector

The attacker requires network reachability to the MySQL Server over any supported protocol and must hold an authenticated account with high privileges. No user interaction is required. Exploitation involves submitting a malicious SQL statement crafted to reach the vulnerable optimizer code path. Refer to the Oracle Security Alert January 2025 for vendor-supplied context.

No public proof-of-concept code is available for CVE-2025-21492. Verified exploitation details have not been released by Oracle or third-party researchers.

Detection Methods for CVE-2025-21492

Indicators of Compromise

Repeated unexpected mysqld process crashes or restarts recorded in the MySQL error log.
Sudden spikes in query execution time or optimizer stalls tied to a single authenticated session.
Loss of availability for NetApp Active IQ Unified Manager, OnCommand Insight, or OnCommand Workflow Automation dashboards backed by MySQL.

Detection Strategies

Monitor MySQL error logs and the performance_schema for repeated optimizer hangs and abnormal query termination events.
Correlate authenticated session activity with database service restarts to identify potentially malicious high-privileged accounts.
Compare deployed MySQL Server versions against the fixed versions in the Oracle January 2025 Critical Patch Update using vulnerability management tooling.

Monitoring Recommendations

Enable the MySQL slow query log and audit plugin to capture long-running or repeatedly failing statements.
Alert on mysqld process exits or systemd service restarts in host telemetry.
Track database availability service-level objectives to surface DoS conditions quickly.

How to Mitigate CVE-2025-21492

Immediate Actions Required

Apply the Oracle January 2025 Critical Patch Update to all affected MySQL Server instances.
Update NetApp Active IQ Unified Manager, OnCommand Insight, and OnCommand Workflow Automation per NetApp Security Advisory NTAP-20250124-0011.
Audit high-privileged MySQL accounts and remove or restrict any that are not strictly required.

Patch Information

Oracle addressed CVE-2025-21492 in the Oracle Critical Patch Update Advisory - January 2025. Administrators should upgrade MySQL Server to a fixed release listed in the advisory. NetApp tracks the downstream fix in NTAP-20250124-0011.

Workarounds

Restrict network access to MySQL Server so that only trusted application hosts can reach the database port.
Remove SUPER, PROCESS, and other high-privileged grants from accounts that do not require them.
Enforce query timeouts using MAX_EXECUTION_TIME hints or the max_execution_time session variable to limit optimizer runaway conditions.

bash

# Configuration example: restrict privileges and enforce query timeout
REVOKE SUPER, PROCESS ON *.* FROM 'app_user'@'%';
SET GLOBAL max_execution_time = 30000; -- 30 seconds
FLUSH PRIVILEGES;