CVE-2025-21521: Oracle MySQL Server DoS Vulnerability

CVE-2025-21521 Overview

CVE-2025-21521 is a denial of service vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Thread Pooling component. This vulnerability allows an unauthenticated attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

Critical Impact

Unauthenticated attackers can remotely crash MySQL Server instances, causing complete service disruption without requiring any user interaction or authentication credentials.

Affected Products

• Oracle MySQL Server versions 8.0.39 and prior
• Oracle MySQL Server versions 8.4.2 and prior
• Oracle MySQL Server versions 9.0.1 and prior

Discovery Timeline

• 2025-01-21 - CVE-2025-21521 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21521

Vulnerability Analysis

This vulnerability resides in the Thread Pooling component of Oracle MySQL Server, which is responsible for managing database connection threads and optimizing resource allocation for concurrent database operations. The flaw is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the Thread Pooling mechanism fails to properly limit or throttle resource allocation under certain conditions.

The vulnerability is easily exploitable by remote attackers who do not require authentication credentials. The attack can be executed via multiple network protocols supported by MySQL Server. Upon successful exploitation, the attacker can trigger a complete denial of service condition, causing the MySQL Server to hang or experience frequent, repeatable crashes.

Root Cause

The root cause stems from improper resource allocation controls within the Thread Pooling component (CWE-770). The vulnerability allows attackers to exhaust server resources by manipulating how the Thread Pooling mechanism allocates and manages connection threads. Without proper limits or throttling mechanisms in place, malicious requests can consume available resources until the server becomes unresponsive or crashes entirely.

Attack Vector

The attack vector is network-based, requiring only that the attacker can reach the MySQL Server over the network. Key characteristics of the exploitation include:

• No authentication required - Attackers do not need valid credentials to exploit this vulnerability
• No user interaction needed - The attack can be fully automated without requiring any action from administrators or users
• Multiple protocol support - The vulnerability can be exploited via various network protocols that MySQL Server accepts

The attack targets the availability of the MySQL Server by manipulating thread pool operations to cause resource exhaustion. This results in either a service hang where the database becomes unresponsive, or repeatable crashes that effectively take the service offline.

Detection Methods for CVE-2025-21521

Indicators of Compromise

• Unusual patterns of connection attempts to MySQL Server ports (default: 3306) from unknown or suspicious IP addresses
• MySQL Server process consuming abnormally high system resources without corresponding legitimate workload
• Frequent MySQL Server crashes or restarts without clear cause in application logs
• Thread pool exhaustion warnings or errors in MySQL error logs

Detection Strategies

• Monitor MySQL Server error logs for thread pool-related errors, crashes, or resource exhaustion messages
• Implement network intrusion detection rules to identify anomalous connection patterns targeting MySQL services
• Configure alerting on MySQL Server availability metrics including uptime, crash frequency, and response times
• Deploy database activity monitoring to track unusual query patterns or connection behaviors

Monitoring Recommendations

• Enable comprehensive MySQL error logging with thread pool diagnostics to capture exploitation attempts
• Implement real-time availability monitoring with automated alerting when MySQL Server becomes unresponsive
• Monitor network traffic to MySQL Server for sudden spikes in connection attempts or unusual protocol behaviors
• Track system resource utilization (CPU, memory, threads) on MySQL Server hosts for anomaly detection

How to Mitigate CVE-2025-21521

Immediate Actions Required

• Apply the latest Oracle Critical Patch Update released January 2025 to all affected MySQL Server instances immediately
• Review network access controls to ensure MySQL Server is not unnecessarily exposed to untrusted networks
• Implement firewall rules to restrict MySQL Server access to only authorized clients and IP ranges
• Consider temporary service isolation for critical MySQL instances until patching is complete

Patch Information

Oracle has released patches addressing this vulnerability in the January 2025 Critical Patch Update. Organizations should upgrade to the following patched versions or later:

• MySQL Server versions newer than 8.0.39 for the 8.0.x branch
• MySQL Server versions newer than 8.4.2 for the 8.4.x branch
• MySQL Server versions newer than 9.0.1 for the 9.0.x branch

For detailed patch information and download links, refer to the Oracle Critical Patch Update Advisory. NetApp customers using MySQL should also review the NetApp Security Advisory NTAP-20250124-0010 for product-specific guidance.

Workarounds

• Implement network-level access controls to restrict MySQL Server connectivity to trusted hosts and networks only
• Configure connection rate limiting at the firewall or load balancer level to mitigate potential resource exhaustion attacks
• Enable MySQL connection control plugins to limit failed connection attempts and implement progressive delays
• Consider deploying MySQL Server behind a database proxy that can provide additional connection filtering and monitoring capabilities

# Example firewall configuration to restrict MySQL access
# Allow MySQL connections only from trusted application servers
iptables -A INPUT -p tcp --dport 3306 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Enable MySQL connection control plugin (requires MySQL restart)
# Add to my.cnf configuration file:
# [mysqld]
# plugin-load-add=connection_control.so
# connection_control_failed_connections_threshold=3
# connection_control_min_connection_delay=1000