CVE-2025-30721: Oracle MySQL Server DoS Vulnerability

CVE-2025-30721 Overview

CVE-2025-30721 is a Denial of Service (DoS) vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: UDF (User-Defined Function) component. This vulnerability allows a highly privileged attacker with local access to the MySQL Server infrastructure to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

The vulnerability requires both high privileges and local access to the system where MySQL Server executes. Additionally, successful exploitation depends on human interaction from a person other than the attacker, making it more difficult to exploit in practice. While the impact is limited to availability (no confidentiality or integrity impact), a complete DoS of a database server can have significant operational consequences for dependent applications and services.

Critical Impact

Successful exploitation can result in a complete denial of service of Oracle MySQL Server, causing database crashes or hangs that disrupt all dependent applications and services.

Affected Products

• Oracle MySQL Server 8.0.0 through 8.0.41
• Oracle MySQL Server 8.4.0 through 8.4.4
• Oracle MySQL Server 9.0.0 through 9.2.0

Discovery Timeline

• April 15, 2025 - CVE-2025-30721 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-30721

Vulnerability Analysis

This vulnerability resides in the User-Defined Function (UDF) component of Oracle MySQL Server. UDFs allow users to extend MySQL functionality by creating custom functions that can be called in SQL statements. The vulnerability enables an attacker with high privileges and local system access to trigger a denial of service condition through the UDF mechanism.

The exploitation scenario requires a combination of factors: the attacker must have high privileges on the MySQL Server, must have local access to the infrastructure where the server executes, and must rely on some form of human interaction from another party. These requirements significantly limit the attack surface and make remote exploitation infeasible.

When successfully exploited, the vulnerability results in either a hang or a frequently repeatable crash of the MySQL Server, effectively achieving a complete denial of service. This impacts only availability—there is no data breach or modification possible through this attack vector.

Root Cause

The specific root cause has not been publicly disclosed by Oracle (classified as NVD-CWE-noinfo). Based on the vulnerability characteristics in the UDF component, the issue likely relates to improper handling of certain inputs or states within user-defined function processing that can trigger an unrecoverable error condition or infinite loop, leading to server instability.

Attack Vector

The attack requires local access to the MySQL Server infrastructure. An attacker must:

1. Have high-level privileges on the MySQL Server instance
2. Have direct access (local login) to the system where MySQL Server runs
3. Trigger specific conditions in the UDF component that cause the server to crash or hang
4. Rely on some form of human interaction to complete the attack chain

The local access requirement and need for high privileges significantly reduces the likelihood of exploitation in most deployment scenarios. This vulnerability cannot be exploited remotely over the network.

Detection Methods for CVE-2025-30721

Indicators of Compromise

• Unexpected MySQL Server crashes or restarts, particularly following UDF-related operations
• MySQL error logs showing repeated crashes associated with user-defined function execution
• Abnormal system behavior on hosts running MySQL Server, especially from privileged local accounts
• Unusual UDF creation or execution patterns from administrative accounts

Detection Strategies

• Monitor MySQL Server error logs for crash events and correlate with UDF activity timestamps
• Implement process monitoring to detect unexpected MySQL Server terminations or hangs
• Audit UDF creation, modification, and execution activities, particularly from privileged accounts
• Deploy endpoint detection solutions to identify suspicious local activity on database servers

Monitoring Recommendations

• Configure alerting for MySQL Server process crashes and unexpected restarts
• Enable MySQL audit logging to track administrative operations and UDF usage
• Monitor system resource utilization for anomalies indicating potential DoS conditions
• Review and baseline normal UDF usage patterns to identify deviations

How to Mitigate CVE-2025-30721

Immediate Actions Required

• Apply the Oracle Critical Patch Update from April 2025 to all affected MySQL Server installations
• Review and restrict high-privilege accounts that have local access to MySQL Server hosts
• Audit current UDF configurations and remove any unnecessary user-defined functions
• Implement principle of least privilege for database administrative accounts

Patch Information

Oracle has addressed this vulnerability in the Oracle Critical Patch Update April 2025. Organizations should upgrade to the following fixed versions:

• MySQL Server 8.0.42 or later (for 8.0.x branch)
• MySQL Server 8.4.5 or later (for 8.4.x branch)
• MySQL Server 9.2.1 or later (for 9.x branch)

Additional advisory information is available from NetApp Security Advisory NTAP-20250502-0006.

Workarounds

• Restrict local login access to MySQL Server hosts to essential personnel only
• Implement strict access controls and monitoring for administrative database accounts
• Consider disabling UDF functionality if not required for business operations by restricting the plugin_dir permissions
• Deploy network segmentation to limit exposure of database infrastructure

# Configuration example - Restrict UDF loading privileges
# Add to my.cnf or my.ini configuration file

[mysqld]
# Restrict plugin directory permissions
plugin_dir=/usr/lib64/mysql/plugin

# Consider disabling UDF loading by revoking INSERT privilege on mysql.func
# Run as MySQL root:
# REVOKE INSERT ON mysql.func FROM 'user'@'host';

# Enable audit logging for administrative operations
audit_log=ON
audit_log_format=JSON
audit_log_policy=LOGINS