CVE-2025-30715: Oracle MySQL Server DOS Vulnerability

CVE-2025-30715 Overview

CVE-2025-30715 is a denial-of-service vulnerability in the Oracle MySQL Server product, specifically within the Server: Components Services component. Affected releases include MySQL Server versions 8.0.0 through 8.0.41, 8.4.0 through 8.4.4, and 9.0.0 through 9.2.0. An authenticated attacker with high privileges and network access via multiple protocols can trigger a hang or repeatable crash, resulting in a complete outage of the database service. Oracle addressed the flaw in the April 2025 Critical Patch Update. The weakness is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Successful exploitation causes a complete denial of service on MySQL Server instances, disrupting downstream applications that depend on database availability.

Affected Products

Oracle MySQL Server 8.0.0 through 8.0.41
Oracle MySQL Server 8.4.0 through 8.4.4
Oracle MySQL Server 9.0.0 through 9.2.0

Discovery Timeline

2025-04-15 - CVE-2025-30715 published to the National Vulnerability Database
April 2025 - Oracle releases fix in the Oracle Critical Patch Update Advisory - April 2025
2025-05-02 - NetApp publishes downstream advisory NTAP-20250502-0006
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-30715

Vulnerability Analysis

The flaw resides in the MySQL Server Components Services subsystem, which manages loadable server components and their lifecycle interfaces. An authenticated attacker with high privileges can send crafted requests over supported protocols to trigger uncontrolled resource consumption. The result is either a service hang or a repeatable crash of the mysqld process, producing a complete availability loss. Confidentiality and integrity are not affected. Because MySQL Server frequently underpins web applications, analytics platforms, and internal services, an outage cascades to any dependent workload. The bug is easily exploitable once valid high-privilege credentials are obtained through prior compromise, credential theft, or misuse by an insider.

Root Cause

The vulnerability is classified as CWE-400: Uncontrolled Resource Consumption. Oracle has not published detailed root-cause information, but the classification indicates that the Components Services code path fails to bound resource use when handling specific input, leading to exhaustion and process failure.

Attack Vector

Exploitation requires network reachability to the MySQL Server listener and an account with high privileges. The attacker interacts with the Components Services interface over one of the supported MySQL protocols. No user interaction is required, and the attack does not need local access to the database host. Oracle does not indicate that public exploit code exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept code is available for CVE-2025-30715. Refer to the Oracle Critical Patch Update Advisory - April 2025 for vendor-supplied technical details.

Detection Methods for CVE-2025-30715

Indicators of Compromise

Unexpected mysqld process termination or restart events recorded in the MySQL error log or systemd journal.
Repeated client connection failures or query timeouts against a MySQL instance that was previously stable.
Authenticated sessions from high-privilege accounts issuing unusual INSTALL COMPONENT, UNINSTALL COMPONENT, or component service calls.

Detection Strategies

Compare installed MySQL Server version against the fixed releases listed in the Oracle April 2025 CPU and flag hosts running vulnerable builds.
Correlate MySQL crash events with preceding authenticated sessions to identify the source account and client IP.
Alert on privileged MySQL logins originating from networks that should not require database administrator access.

Monitoring Recommendations

Ingest MySQL error logs, audit logs, and host process telemetry into a central analytics platform for continuous review.
Track availability metrics such as connection success rate, replication lag, and mysqld uptime to surface DoS conditions quickly.
Monitor use of accounts holding the SYSTEM_VARIABLES_ADMIN, SUPER, or component-management privileges.

How to Mitigate CVE-2025-30715

Immediate Actions Required

Apply the April 2025 Oracle Critical Patch Update to all MySQL Server instances running affected versions.
Inventory database servers to confirm that no unpatched 8.0.x, 8.4.x, or 9.0.x–9.2.0 builds remain in production.
Rotate credentials for high-privilege MySQL accounts if compromise is suspected.

Patch Information

Oracle published the fix in the Oracle Critical Patch Update Advisory - April 2025. Downstream vendors, including NetApp, tracked the issue in NTAP-20250502-0006. Upgrade to MySQL Server 8.0.42, 8.4.5, or 9.3.0 or later, as applicable to each deployment.

Workarounds

Restrict network access to MySQL Server listeners using firewalls, security groups, or bind-address configuration to trusted management networks only.
Reduce the number of accounts holding high privileges and enforce the principle of least privilege on database roles.
Require multi-factor authentication on jump hosts used to reach database administrator interfaces to reduce credential-theft risk.

bash

# Configuration example: limit MySQL listener exposure and audit privileged accounts
# /etc/mysql/mysql.conf.d/mysqld.cnf
[mysqld]
bind-address = 10.0.0.25
skip_name_resolve = ON

# Review accounts with component-management privileges
mysql -u admin -p -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y' OR user IN (SELECT grantee FROM information_schema.user_privileges WHERE privilege_type IN ('SYSTEM_VARIABLES_ADMIN','SUPER'));"