CVE-2025-50101: Oracle MySQL Server Optimizer DOS Vulnerability

CVE-2025-50101 Overview

CVE-2025-50101 is a denial-of-service vulnerability in the Oracle MySQL Server product, specifically within the Server: Optimizer component. The flaw allows an authenticated attacker with high privileges and network access to trigger a hang or repeatable crash of the MySQL Server process. Successful exploitation results in complete availability loss for the database service. Oracle disclosed the issue in the July 2025 Critical Patch Update. Affected releases span MySQL Server 8.0.0 through 8.0.42, 8.4.0 through 8.4.5, and 9.0.0 through 9.3.0. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
An authenticated attacker can crash or hang MySQL Server, producing a complete denial of service against the affected database instance.

Affected Products

Oracle MySQL Server 8.0.0 through 8.0.42
Oracle MySQL Server 8.4.0 through 8.4.5
Oracle MySQL Server 9.0.0 through 9.3.0

Discovery Timeline

2025-07-15 - Oracle publishes CVE-2025-50101 as part of the July 2025 Critical Patch Update
2025-07-15 - CVE-2025-50101 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50101

Vulnerability Analysis

The vulnerability resides in the MySQL Server query optimizer, the component responsible for planning execution strategies for SQL statements. A malformed or specifically crafted query can drive the optimizer into a state that consumes uncontrolled resources or triggers a fatal condition, causing the mysqld process to hang or crash. Because MySQL Server typically services many concurrent clients, a single crash affects all sessions and dependent applications. The issue is classified under [CWE-400] (Uncontrolled Resource Consumption), reflecting the exhaustion or fault behavior in optimizer processing rather than a memory-safety bug. Availability is the only impacted security property; confidentiality and integrity are not affected. The EPSS probability is 0.468%, indicating a low projected likelihood of exploitation activity at publication.

Root Cause

The root cause is improper handling of specific query patterns within the optimizer, allowing certain inputs to consume disproportionate resources or reach an unrecoverable state. Oracle has not published the internal code path in its advisory. The fix ships as part of the July 2025 Critical Patch Update bundle.

Attack Vector

Exploitation requires network access to the MySQL Server through any supported protocol, such as the MySQL native protocol on TCP 3306 or MySQL X Protocol on TCP 33060. The attacker must already hold high privileges, meaning a valid authenticated account with elevated database rights. No user interaction is required. Once connected, the attacker submits the triggering query, and the server hangs or crashes. The vulnerability is not remotely exploitable by unauthenticated users. Refer to the Oracle Critical Patch Update July 2025 advisory for scope details.

Detection Methods for CVE-2025-50101

Indicators of Compromise

Unexpected mysqld process crashes, restarts, or hangs recorded in the MySQL error log or systemd journal.
Repeated abnormal terminations of MySQL Server correlating with sessions from a specific authenticated account or client IP.
Sudden spikes in Threads_running, CPU, or memory consumption tied to individual queries just before service failure.

Detection Strategies

Enable and review the MySQL general query log or audit log to correlate specific SQL statements from privileged accounts with crash events.
Monitor mysqld exit codes and core dump generation, and alert on any non-graceful shutdown.
Compare running MySQL Server versions against the fixed releases listed in Oracle's July 2025 CPU to identify unpatched instances.

Monitoring Recommendations

Track connection sources and query patterns from all high-privilege accounts, including SUPER, PROCESS, and DBA-role users.
Instrument database availability with external health checks that alert on connection failures or query timeouts.
Forward MySQL error logs and audit records to a centralized logging or SIEM platform for retention and correlation.

How to Mitigate CVE-2025-50101

Immediate Actions Required

Apply the patches published in the Oracle Critical Patch Update July 2025 to all affected MySQL Server instances.
Inventory MySQL deployments and prioritize internet-exposed or business-critical database servers for immediate remediation.
Audit accounts holding administrative privileges and revoke unnecessary elevated rights to reduce the pool of potential attackers.

Patch Information

Oracle addressed CVE-2025-50101 in the July 2025 Critical Patch Update. Upgrade MySQL Server to a release later than 8.0.42 within the 8.0 branch, later than 8.4.5 within the 8.4 branch, or later than 9.3.0 within the 9.x branch. Consult the Oracle Critical Patch Update July 2025 advisory for the exact fixed version applicable to each branch and platform.

Workarounds

Restrict network reachability of MySQL Server ports (3306, 33060) to trusted application hosts using firewall rules or security groups.
Enforce least privilege by removing administrative roles from application accounts and limiting DBA access to named individuals.
Enable resource controls such as MAX_EXECUTION_TIME hints, per-user max_user_connections, and query timeouts to contain runaway statements.
Configure automatic restart of the mysqld service via systemd or a process supervisor to reduce downtime if the server crashes.

bash

# Example: restrict MySQL access at the OS firewall and enable automatic restart
sudo firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" source address="10.0.0.0/24" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

# Ensure mysqld restarts on failure (systemd drop-in)
sudo mkdir -p /etc/systemd/system/mysqld.service.d
sudo tee /etc/systemd/system/mysqld.service.d/restart.conf <<EOF
[Service]
Restart=on-failure
RestartSec=5s
EOF
sudo systemctl daemon-reload
sudo systemctl restart mysqld