CVE-2025-21574: Oracle MySQL Cluster DOS Vulnerability

CVE-2025-21574 Overview

CVE-2025-21574 is a Denial of Service vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Parser component. This vulnerability allows a low-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

The vulnerability is classified as easily exploitable, requiring only low privileges and network access via multiple protocols. This makes it particularly concerning for organizations running affected MySQL Server versions in network-accessible environments, as authenticated users could potentially disrupt database availability.

Critical Impact

Authenticated attackers can cause complete denial of service by triggering a hang or repeatable crash of MySQL Server, disrupting database-dependent applications and services.

Affected Products

• Oracle MySQL Server versions 8.0.0 through 8.0.41
• Oracle MySQL Server versions 8.4.0 through 8.4.4
• Oracle MySQL Server versions 9.0.0 through 9.2.0
• Oracle MySQL Cluster (affected versions align with MySQL Server)

Discovery Timeline

• 2025-04-15 - CVE-2025-21574 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21574

Vulnerability Analysis

This vulnerability resides in the Server: Parser component of Oracle MySQL Server. The parser is responsible for interpreting and processing SQL statements submitted by clients. A flaw in the parsing logic can be exploited by an authenticated user to trigger resource exhaustion or uncontrolled resource consumption (CWE-400), leading to a denial of service condition.

The attack can be executed remotely over the network via multiple protocols, requiring only low-level database privileges. This means any authenticated database user could potentially exploit this vulnerability to disrupt service availability. The impact is limited to availability—there is no unauthorized access to data or ability to modify information.

Root Cause

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption). The MySQL Server Parser component fails to properly handle certain malformed or specially crafted SQL statements, leading to resource exhaustion. This improper resource management allows attackers to consume excessive server resources, causing the database to hang or crash repeatedly.

Attack Vector

The attack vector is network-based, allowing exploitation from remote locations. An attacker needs:

1. Network Access: Connectivity to the MySQL Server via supported protocols
2. Low Privileges: Basic authentication credentials (any valid database user account)
3. Crafted Requests: Ability to submit specially crafted SQL statements to the parser

The exploitation complexity is low, requiring no user interaction. Once a malicious query is submitted, the parser processes it in a way that leads to resource exhaustion, causing the server to become unresponsive or crash. The attack can be repeated to maintain a persistent denial of service condition.

The vulnerability manifests when the Server: Parser component processes specific input patterns that trigger uncontrolled resource consumption. Technical details regarding the specific exploitation mechanism can be found in the Oracle Security Alert April 2025.

Detection Methods for CVE-2025-21574

Indicators of Compromise

• Unusual patterns of MySQL Server crashes or hangs without apparent cause
• Repeated connection attempts followed by server unresponsiveness
• Abnormal CPU or memory consumption spikes on MySQL Server hosts
• Error logs indicating parser-related failures or resource exhaustion

Detection Strategies

• Monitor MySQL error logs for repeated crash patterns or parser-related error messages
• Implement database activity monitoring to detect unusual query patterns from authenticated users
• Track resource consumption metrics (CPU, memory) on MySQL Server hosts for sudden spikes
• Enable MySQL audit logging to capture and analyze suspicious query submissions

Monitoring Recommendations

• Configure alerting for MySQL Server process restarts or unexpected terminations
• Establish baseline metrics for normal parser performance and alert on deviations
• Deploy network monitoring to detect unusual traffic patterns to MySQL ports (3306/tcp)
• Implement query analysis tools to identify potentially malicious SQL statement patterns

How to Mitigate CVE-2025-21574

Immediate Actions Required

• Apply the latest Oracle Critical Patch Update (CPU) from April 2025 as soon as possible
• Review and restrict database user privileges to the minimum required for operations
• Limit network access to MySQL Server to trusted hosts and networks only
• Increase monitoring on MySQL Server instances for signs of exploitation attempts

Patch Information

Oracle has released patches addressing this vulnerability as part of the April 2025 Critical Patch Update. Organizations should apply the appropriate patches based on their MySQL Server version:

• MySQL Server 8.0.x: Upgrade to version 8.0.42 or later
• MySQL Server 8.4.x: Upgrade to version 8.4.5 or later
• MySQL Server 9.x: Upgrade to version 9.2.1 or later

For detailed patch information and download links, refer to the Oracle Security Alert April 2025. Additional vendor guidance is available from the NetApp Security Advisory NTAP-20250502-0006.

Workarounds

• Implement strict network access controls to limit connectivity to MySQL Server
• Enforce the principle of least privilege for all database accounts
• Consider deploying a database firewall or proxy to filter potentially malicious queries
• Enable connection rate limiting to reduce the impact of repeated exploitation attempts
• Temporarily revoke network access from untrusted or unnecessary database accounts

# Example: Restrict MySQL network access using iptables
iptables -A INPUT -p tcp --dport 3306 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Review and audit database user privileges
mysql -u root -p -e "SELECT user, host FROM mysql.user;"