CVE-2025-21580: Oracle MySQL Server DOS Vulnerability

CVE-2025-21580 Overview

CVE-2025-21580 is a denial-of-service vulnerability in the Data Manipulation Language (DML) component of Oracle MySQL Server. The flaw allows a high-privileged attacker with network access via multiple protocols to trigger a hang or repeatable crash of the MySQL Server process. Successful exploitation results in a complete denial of service against the database instance.

Affected releases include MySQL Server 8.0.0-8.0.41, 8.4.0-8.4.4, and 9.0.0-9.2.0. Oracle addressed the issue in the April 2025 Critical Patch Update. The vulnerability is categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource.

Critical Impact
An authenticated attacker with high privileges can crash or hang MySQL Server through crafted DML operations, producing full availability loss for downstream applications.

Affected Products

Oracle MySQL Server versions 8.0.0 through 8.0.41
Oracle MySQL Server versions 8.4.0 through 8.4.4
Oracle MySQL Server versions 9.0.0 through 9.2.0

Discovery Timeline

2025-04-15 - Oracle publishes the vulnerability in the April 2025 Critical Patch Update
2025-04-15 - CVE-2025-21580 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21580

Vulnerability Analysis

The defect resides in the Server: DML subsystem of MySQL, which handles INSERT, UPDATE, DELETE, and SELECT execution paths. An authenticated attacker who already holds elevated database privileges can submit crafted DML statements that force the server into an unrecoverable state. The result is either an indefinite hang of the server process or a reproducible crash that terminates active sessions and blocks new connections.

Because the vulnerability targets availability only, it does not permit data disclosure or modification. However, in production environments where MySQL underpins transactional applications, a crash cascades into service outages for every dependent workload. The attack is network-reachable through any MySQL-supported protocol, including the classic MySQL protocol and X Protocol.

Root Cause

The issue is classified under [CWE-732] Incorrect Permission Assignment for Critical Resource. The DML component fails to correctly constrain how privileged operations interact with internal server resources, allowing a legitimate high-privilege user to reach a code path that produces an unrecoverable failure. Oracle's advisory does not publicly disclose the exact function or query pattern involved.

Attack Vector

Exploitation requires an authenticated session with high privileges on the target MySQL instance. The attacker connects over the network, authenticates, and issues the malicious DML sequence. No user interaction is needed. The scope remains unchanged, and confidentiality and integrity are unaffected. The realistic risk profile centers on insider misuse, compromised administrative credentials, or lateral movement following credential theft.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability sits below one percent, indicating low observed exploitation activity.

Detection Methods for CVE-2025-21580

Indicators of Compromise

Unexpected mysqld process crashes or restarts recorded in the MySQL error log or systemd journal.
Repeated server hangs coinciding with authenticated sessions from unusual source hosts.
Sudden spikes in aborted connections or SIGSEGV entries in /var/log/mysql/error.log.

Detection Strategies

Monitor MySQL general query and audit logs for anomalous DML patterns issued by privileged accounts immediately preceding server failure.
Correlate database process termination events with authentication events for administrative users to identify potential abuse.
Track version banners across the MySQL fleet to identify hosts still running 8.0.0-8.0.41, 8.4.0-8.4.4, or 9.0.0-9.2.0.

Monitoring Recommendations

Enable the MySQL Enterprise Audit plugin or an equivalent open-source audit log to capture every statement executed by privileged accounts.
Alert on repeated mysqld restarts within a short interval, which often indicate a repeatable crash condition.
Baseline expected query patterns for administrative users and flag deviations that precede availability incidents.

How to Mitigate CVE-2025-21580

Immediate Actions Required

Apply the fixes shipped in the Oracle Critical Patch Update April 2025 to all affected MySQL Server instances.
Inventory MySQL deployments and prioritize patching for internet-exposed and business-critical databases.
Audit accounts granted high privileges such as SUPER, PROCESS, or broad DML rights, and revoke unnecessary grants.

Patch Information

Oracle addressed CVE-2025-21580 in the April 2025 Critical Patch Update. Administrators should upgrade to MySQL Server 8.0.42, 8.4.5, 9.3.0, or later. NetApp customers should review NetApp Security Advisory NTAP-20250502-0006 for guidance on bundled MySQL components.

Workarounds

Restrict network access to MySQL listeners using firewall rules or security groups that only permit trusted application hosts.
Enforce least privilege by removing administrative rights from application service accounts.
Require strong authentication and rotate credentials for any account holding privileges sufficient to reach the vulnerable DML paths.

bash

# Configuration example: restrict MySQL to trusted networks and reduce privileged surface
# 1. Bind MySQL to a specific interface in /etc/mysql/my.cnf
[mysqld]
bind-address = 10.0.0.15

# 2. Limit which hosts a high-privilege account can connect from
RENAME USER 'admin'@'%' TO 'admin'@'10.0.0.20';

# 3. Revoke unnecessary global privileges
REVOKE SUPER, PROCESS ON *.* FROM 'app_user'@'%';
FLUSH PRIVILEGES;