CVE-2025-50084: Oracle MySQL Server Optimizer DOS Vulnerability

CVE-2025-50084 Overview

CVE-2025-50084 is a denial-of-service vulnerability in the Oracle MySQL Server Optimizer component. Oracle disclosed the flaw in the July 2025 Critical Patch Update. The vulnerability affects MySQL Server versions 8.0.0-8.0.42, 8.4.0-8.4.5, and 9.0.0-9.3.0. An authenticated attacker with high privileges and network access can trigger a hang or repeatable crash, resulting in a complete denial of service of the MySQL Server instance. The Common Weakness Enumeration classification is [CWE-863] Incorrect Authorization. No confidentiality or integrity impact is associated with this issue.

Critical Impact
Successful exploitation causes a complete denial of service of the affected MySQL Server, disrupting all database-dependent applications and services.

Affected Products

Oracle MySQL Server 8.0.0 through 8.0.42
Oracle MySQL Server 8.4.0 through 8.4.5
Oracle MySQL Server 9.0.0 through 9.3.0

Discovery Timeline

2025-07-15 - Oracle publishes the July 2025 Critical Patch Update containing the fix
2025-07-15 - CVE-2025-50084 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-50084

Vulnerability Analysis

The vulnerability resides in the MySQL Server Optimizer, the subsystem that transforms SQL queries into execution plans. A specifically crafted query processed by the Optimizer causes the server to hang or crash in a repeatable manner. The impact is limited to availability; the flaw does not expose data or allow modification of stored records.

Exploitation requires authenticated access with high privileges over the network. Oracle marks the attack complexity as low, meaning a privileged user can trigger the condition without complex preconditions. Multiple MySQL protocols expose the vulnerable code path, expanding the potential surface for exploitation across client connections and administrative interfaces.

Because a single crash affects the entire server process, a successful attack disrupts every application and tenant that depends on the affected instance. In replicated or clustered deployments, repeated crashes can propagate operational disruption to standby nodes and connected services.

Root Cause

The [CWE-863] Incorrect Authorization classification indicates that the Optimizer performs authorization decisions incorrectly for certain query patterns. This allows an authenticated attacker with high privileges to submit input that reaches unstable code paths in the Optimizer, resulting in a hang or crash. Oracle has not published detailed technical internals for the flaw.

Attack Vector

The attack originates over the network through standard MySQL protocols. The attacker authenticates with a high-privilege account and submits a crafted query that the Optimizer fails to process safely. No user interaction is required, and the scope is unchanged. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is publicly available. Refer to the Oracle Critical Patch Update July 2025 advisory for vendor-supplied guidance.

Detection Methods for CVE-2025-50084

Indicators of Compromise

Unexpected mysqld process termination or restart events recorded in operating system logs and MySQL error logs.
Repeated connection resets and query timeouts originating from a specific authenticated database account.
MySQL error log entries referencing Optimizer crashes, signal handlers, or stack traces immediately after query execution.

Detection Strategies

Enable the MySQL general query log or audit log to capture the full statement text submitted before crash events.
Correlate mysqld process exit codes with authenticated session identifiers to attribute crashes to specific users.
Baseline query patterns from privileged accounts and alert on anomalous or malformed statements that immediately precede service failure.

Monitoring Recommendations

Monitor MySQL uptime metrics and alert on unexpected restarts or service availability drops.
Track failed authentication and privilege escalation attempts targeting accounts with administrative rights.
Forward MySQL audit and error logs to a centralized SIEM for correlation with process crash telemetry.

How to Mitigate CVE-2025-50084

Immediate Actions Required

Apply the July 2025 Oracle Critical Patch Update to all affected MySQL Server instances.
Inventory MySQL deployments to identify versions 8.0.0-8.0.42, 8.4.0-8.4.5, and 9.0.0-9.3.0.
Review and restrict accounts holding high-privilege roles such as SUPER, SYSTEM_VARIABLES_ADMIN, and other administrative grants.
Rotate credentials for any privileged accounts suspected of exposure or shared use.

Patch Information

Oracle addressed CVE-2025-50084 in the July 2025 Critical Patch Update. Administrators should upgrade to a fixed release beyond the affected version ranges. See the Oracle Critical Patch Update July 2025 advisory for the full list of fixed builds and download locations.

Workarounds

Restrict network access to MySQL Server using firewall rules that permit connections only from trusted application hosts and administrative jump servers.
Enforce least-privilege for database accounts and remove high-privilege grants from application service accounts.
Require strong authentication and multi-factor authentication for administrative access paths that reach MySQL.

bash

# Configuration example: restrict network exposure and audit privileged accounts
# 1. Bind MySQL to a trusted interface in my.cnf
# bind-address = 10.0.0.10

# 2. Review users holding administrative privileges
mysql -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y';"

# 3. Revoke unnecessary high privileges from application accounts
mysql -e "REVOKE SUPER ON *.* FROM 'app_user'@'%';"
mysql -e "FLUSH PRIVILEGES;"