CVE-2025-21584: Oracle MySQL Server DDL DoS Vulnerability

CVE-2025-21584 Overview

CVE-2025-21584 is a denial-of-service vulnerability in the Data Definition Language (DDL) component of Oracle MySQL Server. The flaw allows an authenticated attacker with high privileges and network access to trigger a hang or repeatable crash of the MySQL Server process. Oracle disclosed the issue in the April 2025 Critical Patch Update. Affected releases span MySQL Server versions 8.0.0-8.0.41, 8.4.0-8.4.4, and 9.0.0-9.2.0. The weakness is classified under [CWE-732] (Incorrect Permission Assignment for Critical Resource). Exploitation results in complete availability loss for the database service while confidentiality and integrity remain unaffected.

Critical Impact
Successful exploitation causes a complete denial of service against MySQL Server, disrupting all dependent applications and workloads.

Affected Products

Oracle MySQL Server 8.0.0 through 8.0.41
Oracle MySQL Server 8.4.0 through 8.4.4
Oracle MySQL Server 9.0.0 through 9.2.0

Discovery Timeline

2025-04-15 - Oracle publishes the vulnerability in the April 2025 Critical Patch Update
2025-04-15 - CVE-2025-21584 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21584

Vulnerability Analysis

The vulnerability resides in the DDL subsystem of Oracle MySQL Server. DDL statements manage schema objects such as tables, indexes, and views. A specific DDL operation issued by a high-privileged account can drive the server into a hang state or trigger a repeatable crash. Oracle characterizes the condition as easily exploitable once network access and elevated privileges exist. The impact is limited to availability, meaning the database becomes unresponsive but stored data is not disclosed or altered. The vulnerability is reachable across multiple MySQL protocols, expanding the attack surface beyond the default listener.

Root Cause

Oracle categorizes the flaw under [CWE-732], indicating incorrect permission assignment for a critical resource within the DDL handling logic. The privileged operation is not adequately constrained, allowing certain schema-modification requests to place the server in an unrecoverable state. Oracle does not publish detailed root-cause internals for MySQL Server DDL bugs in the Critical Patch Update advisory.

Attack Vector

An attacker requires authenticated access with high privileges on the target MySQL Server. From that position, the attacker connects over the network using any supported MySQL protocol and issues the malformed DDL request. No user interaction is required. The result is a hang or crash that persists across restart attempts if the trigger is repeated. Because valid administrative credentials are required, insider threat and compromised service-account scenarios represent the primary exploitation paths.

No public proof-of-concept exploit is available at the time of this writing. See the Oracle Critical Patch Update advisory for the vendor description.

Detection Methods for CVE-2025-21584

Indicators of Compromise

Unexpected mysqld process crashes or hangs correlated with recent DDL activity in the MySQL error log.
Repeated connection failures or timeouts from application tiers immediately following administrative sessions.
Stack traces or assertion failures in hostname.err referencing DDL execution paths.

Detection Strategies

Enable the MySQL general query log or audit plugin to capture DDL statements issued by privileged accounts.
Alert on abnormal frequency of CREATE, ALTER, or DROP statements originating from a single session.
Correlate MySQL server restarts with the last DDL statement executed prior to failure.

Monitoring Recommendations

Monitor mysqld process availability and restart counts through host-based telemetry.
Track authenticated sessions holding SUPER, CREATE, ALTER, or DROP privileges and baseline their normal DDL workload.
Ingest MySQL error and audit logs into a centralized analytics platform for correlation with authentication events.

How to Mitigate CVE-2025-21584

Immediate Actions Required

Apply the fixes published in the Oracle April 2025 Critical Patch Update to all affected MySQL Server instances.
Review accounts holding administrative privileges and revoke those no longer required.
Restrict network exposure of MySQL listeners to trusted application subnets only.

Patch Information

Oracle addressed CVE-2025-21584 in the April 2025 Critical Patch Update. Upgrade MySQL Server to a release later than 8.0.41, 8.4.4, or 9.2.0 within the respective branches. NetApp products bundling MySQL are covered in NetApp Security Advisory NTAP-20250502-0006. Verify downstream distributions and appliance vendors for their corresponding patch releases.

Workarounds

Limit DDL privileges to a minimal set of operational accounts and enforce just-in-time access for schema changes.
Enforce network segmentation and firewall rules to block direct MySQL protocol access from untrusted hosts.
Enable connection rate limiting and audit logging to detect abuse patterns before they cause outages.

bash

# Restrict schema-modification privileges to a dedicated DBA role
REVOKE CREATE, ALTER, DROP, INDEX ON *.* FROM 'app_user'@'%';
FLUSH PRIVILEGES;

# Bind MySQL to an internal interface only
# /etc/mysql/mysql.conf.d/mysqld.cnf
# bind-address = 10.0.0.15