CVE-2025-53045: Oracle MySQL Server InnoDB DOS Vulnerability

CVE-2025-53045 Overview

CVE-2025-53045 is a denial-of-service vulnerability in the InnoDB storage engine of Oracle MySQL Server. The flaw allows a high-privileged attacker with network access to crash or hang the database through multiple MySQL protocols. Oracle disclosed the issue in the October 2025 Critical Patch Update. Affected releases include MySQL Server 8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0. The vulnerability affects availability only, with no impact on confidentiality or integrity. It is categorized under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Successful exploitation produces a complete denial of service on the MySQL Server through a hang or a repeatable crash.

Affected Products

Oracle MySQL Server versions 8.0.0 through 8.0.43
Oracle MySQL Server versions 8.4.0 through 8.4.6
Oracle MySQL Server versions 9.0.0 through 9.4.0

Discovery Timeline

2025-10-21 - CVE-2025-53045 published to NVD as part of the Oracle October 2025 Critical Patch Update
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-53045

Vulnerability Analysis

The vulnerability resides in the InnoDB storage engine, the default transactional engine used by Oracle MySQL Server. InnoDB manages buffer pools, redo logs, and row-level locking for most production MySQL workloads. A flaw in how InnoDB handles specific input or operations lets an authenticated attacker trigger a hang or crash. The server either stops responding to new queries or terminates, requiring a restart and recovery of InnoDB state. Oracle has not published root-cause details beyond classifying the issue under uncontrolled resource consumption [CWE-400].

Root Cause

The underlying weakness is uncontrolled resource consumption within InnoDB. Operations issued over supported MySQL protocols consume resources without proper limits or validation, which exhausts server capacity and triggers the crash or hang. Oracle has not released source-level details of the defective code path.

Attack Vector

Exploitation requires network access to MySQL Server over any supported protocol, including the classic MySQL protocol and MySQL X Protocol. The attacker must already hold high privileges on the database, such as administrative or DBA-level credentials. No user interaction is required. Because the attack is network-reachable and low-complexity, compromised administrative credentials or insider abuse are the primary realistic exploitation paths.

No verified proof-of-concept code is publicly available. See the Oracle October 2025 Critical Patch Update for vendor-provided details.

Detection Methods for CVE-2025-53045

Indicators of Compromise

Unexpected mysqld process termination with InnoDB assertion failures in the MySQL error log
Repeated server restarts followed by InnoDB crash recovery messages
Sudden spikes in connection queue depth, query latency, or thread stalls followed by server unresponsiveness
Repeated administrative sessions from a single source immediately preceding instability

Detection Strategies

Correlate MySQL error log entries referencing InnoDB with process exit events on the host operating system
Monitor administrative session activity for anomalous query patterns originating from DBA-level accounts
Alert on repeated crash-recovery sequences within short time windows across database fleets

Monitoring Recommendations

Ingest MySQL error logs, general query logs, and audit logs into a centralized analytics platform
Baseline normal mysqld uptime, connection counts, and InnoDB buffer pool metrics to flag deviations
Track usage of high-privilege MySQL accounts and alert on activity outside of change windows

How to Mitigate CVE-2025-53045

Immediate Actions Required

Apply the fixes delivered in the Oracle October 2025 Critical Patch Update to all affected MySQL Server instances
Inventory MySQL Server deployments to identify any instance running 8.0.0-8.0.43, 8.4.0-8.4.6, or 9.0.0-9.4.0
Rotate credentials for high-privilege MySQL accounts if compromise is suspected

Patch Information

Oracle addressed CVE-2025-53045 in the October 2025 Critical Patch Update. Upgrade MySQL Server to a release later than 8.0.43 on the 8.0 branch, later than 8.4.6 on the 8.4 branch, or later than 9.4.0 on the 9.x branch. Refer to the Oracle October 2025 Critical Patch Update advisory for exact fixed version numbers and download instructions.

Workarounds

Restrict network access to MySQL Server through firewall rules so only trusted application and administration hosts can reach port 3306 and the X Protocol port 33060
Minimize the number of accounts granted administrative or DBA privileges and audit existing grants with SHOW GRANTS
Enforce multi-factor authentication and jump-host access controls for all privileged database sessions
Deploy MySQL in a high-availability topology so a single instance crash does not cause full service outage

bash

# Configuration example: restrict high-privilege account scope and network exposure
# Review current privileged accounts
mysql -e "SELECT user, host FROM mysql.user WHERE Super_priv='Y' OR Shutdown_priv='Y';"

# Bind MySQL to a management interface only
# In my.cnf under [mysqld]
# bind-address = 10.0.0.10
# mysqlx_bind_address = 10.0.0.10

# Firewall example (restrict 3306 and 33060 to trusted subnet)
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 33060 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
iptables -A INPUT -p tcp --dport 33060 -j DROP