CVE-2025-50094: Oracle MySQL Server DDL DOS Vulnerability

CVE-2025-50094 Overview

CVE-2025-50094 is a denial of service vulnerability in the Oracle MySQL Server product, specifically within the Server: DDL (Data Definition Language) component. The flaw affects supported versions 8.0.42, 8.4.5, and 9.3.0. An authenticated attacker with high privileges and network access via multiple protocols can trigger a hang or repeatable crash of the MySQL Server process. Oracle addressed the issue in the July 2025 Critical Patch Update. The weakness is tracked under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
Successful exploitation produces a complete denial of service against the MySQL Server, interrupting database availability for all dependent applications.

Affected Products

Oracle MySQL Server 8.0.42
Oracle MySQL Server 8.4.5
Oracle MySQL Server 9.3.0

Discovery Timeline

2025-07-15 - Oracle publishes CVE-2025-50094 as part of the July 2025 Critical Patch Update
2025-07-15 - CVE-2025-50094 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50094

Vulnerability Analysis

The vulnerability resides in the DDL subsystem of MySQL Server, which handles statements such as CREATE, ALTER, and DROP. Crafted DDL input causes uncontrolled resource consumption in the server process. The resulting condition is either a hang or a crash that terminates all active connections.

The issue is classified under CWE-400, indicating that server-side logic fails to bound resource usage when processing specific DDL requests. Because MySQL Server often sits in the critical path of application stacks, a single abusive session can degrade or disable services across multiple downstream consumers.

Oracle rates confidentiality and integrity impact as none; the exposure is strictly availability. However, repeatable crash conditions can be used by an insider or a compromised application account to achieve persistent outages until the underlying statement pattern is blocked or the server is patched.

Root Cause

The root cause is improper handling of resource limits inside the Server: DDL component. Oracle has not published implementation specifics, but the CWE-400 classification indicates that the server does not adequately constrain memory, CPU, or lock resources consumed by the vulnerable DDL path. Processing certain inputs drives the server into a state where it either exhausts resources or dereferences invalid state, producing the observed hang or crash.

Attack Vector

Exploitation requires an authenticated session with high privileges on the MySQL Server. The attacker reaches the server over the network through any of the protocols MySQL exposes, which commonly include the native MySQL protocol and the X Protocol. User interaction is not required. The attacker issues the malicious DDL statement, after which the server hangs or crashes. Repeating the statement reproduces the denial of service.

No verified public proof-of-concept code or exploit entry exists for CVE-2025-50094 at this time. Oracle has not released technical details for the vulnerable code path. Refer to the Oracle July 2025 Critical Patch Update for authoritative advisory information.

Detection Methods for CVE-2025-50094

Indicators of Compromise

Unexpected mysqld process crashes or restarts recorded in the MySQL error log without a corresponding administrator action.
Repeated DDL statements (CREATE, ALTER, DROP) issued by a single high-privileged account immediately before a server hang or crash.
Sudden spikes in server CPU, memory, or metadata-lock wait times correlated with specific DDL activity.
Loss of client connectivity across multiple applications sharing the same MySQL instance.

Detection Strategies

Audit mysql.general_log or the audit log plugin for DDL statements issued by privileged accounts and alert on anomalous frequency or syntax.
Correlate mysqld process termination events with the last executed statement captured in query logs to identify triggering patterns.
Monitor the performance_schema for abnormal metadata locks and long-running DDL events preceding crashes.

Monitoring Recommendations

Ingest MySQL error logs, slow query logs, and audit logs into a centralized analytics platform for cross-session correlation.
Track MySQL version strings across the fleet to confirm whether hosts still run 8.0.42, 8.4.5, or 9.3.0.
Alert on any mysqld restarts combined with privileged DDL activity within a short time window.

How to Mitigate CVE-2025-50094

Immediate Actions Required

Apply the Oracle Critical Patch Update released in July 2025 to all affected MySQL Server instances.
Inventory MySQL deployments and confirm versions 8.0.42, 8.4.5, and 9.3.0 are upgraded to the patched releases listed in the Oracle advisory.
Review and reduce the number of accounts granted DDL-capable privileges such as CREATE, ALTER, and DROP.
Rotate credentials for any privileged database accounts that may have been exposed through application vulnerabilities.

Patch Information

Oracle addressed CVE-2025-50094 in the July 2025 Critical Patch Update. Patched versions and download instructions are documented in the Oracle July 2025 Security Alert. Customers using Oracle MySQL Enterprise should apply the vendor-supplied binaries, and users of MySQL Community Edition should upgrade to the corresponding fixed release in the 8.0, 8.4 LTS, and 9.x series.

Workarounds

Restrict network access to the MySQL Server to trusted application hosts and administrative jump boxes using firewall rules or security groups.
Enforce least privilege by removing DDL privileges from application service accounts that only require DML operations.
Require TLS and strong authentication on all MySQL listeners, including the X Protocol port, to limit who can reach the vulnerable code path.
Enable automated recovery and health checks so a crashed mysqld restarts quickly while patching is scheduled.

bash

# Example: revoke DDL privileges from an application account
REVOKE CREATE, ALTER, DROP ON appdb.* FROM 'app_user'@'%';
FLUSH PRIVILEGES;