CVE-2025-53067: Oracle MySQL Server DOS Vulnerability

CVE-2025-53067 Overview

CVE-2025-53067 is a denial of service vulnerability in the Oracle MySQL Server Optimizer component. The flaw affects MySQL Server versions 9.0.0 through 9.4.0. A high-privileged attacker with network access can exploit the issue over multiple protocols to cause a hang or a frequently repeatable crash, resulting in complete denial of service of the database.

Oracle addressed the vulnerability in the Oracle Critical Patch Update October 2025. The weakness is classified as [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A successful attack causes complete availability loss of the MySQL Server, disrupting all dependent applications and services until the process is restarted.

Affected Products

Oracle MySQL Server 9.0.0
Oracle MySQL Server 9.1.0 through 9.3.0
Oracle MySQL Server 9.4.0

Discovery Timeline

2025-10-21 - CVE-2025-53067 published to the National Vulnerability Database
2025-10-21 - Oracle releases fix in the October 2025 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53067

Vulnerability Analysis

The vulnerability resides in the MySQL Server Optimizer, the component responsible for building query execution plans. Specially crafted SQL statements trigger uncontrolled resource consumption during query planning or evaluation. The result is a server hang or repeatable crash that terminates active sessions.

Exploitation requires an authenticated account with high privileges on the database. However, no user interaction is required, and the attack can be delivered remotely over any protocol MySQL exposes, including the native MySQL protocol and MySQL X Protocol.

The issue impacts availability only. Confidentiality and integrity of stored data are not directly affected, but downstream services relying on the database will fail while the server is unresponsive.

Root Cause

The root cause is uncontrolled resource consumption within the query optimizer [CWE-400]. Specific SQL constructs cause the optimizer to consume excessive CPU or memory, or enter a state that produces a fatal error. Oracle's Critical Patch Update advisory does not publish the exact code path, consistent with Oracle's disclosure policy.

Attack Vector

The attack requires network reachability to the MySQL Server and valid credentials for a high-privileged account, such as a role with CREATE, SELECT, or administrative privileges on targeted schemas. The attacker submits a malicious query that the optimizer cannot process safely, causing the server to hang or crash.

Because exploitation is repeatable, the attacker can maintain a sustained outage by re-issuing the query after each restart. Environments where high-privilege accounts are shared across applications, or where developer accounts hold broad privileges in production, are at elevated risk.

No public proof-of-concept exploit is available. No entry exists in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score reflects a low probability of near-term exploitation.

Detection Methods for CVE-2025-53067

Indicators of Compromise

Unexpected mysqld process crashes or restarts recorded in the MySQL error log, particularly with stack traces referencing the optimizer.
Sudden CPU or memory saturation on the database host coinciding with specific incoming queries.
Repeated client-side errors such as Lost connection to MySQL server during query from a single authenticated session.

Detection Strategies

Enable the MySQL slow query log and general query log to capture queries executed immediately before a crash for forensic review.
Correlate mysqld restart events with authentication logs to identify which high-privileged account issued the triggering query.
Deploy database activity monitoring to flag anomalous query patterns from privileged accounts that deviate from application baselines.

Monitoring Recommendations

Alert on repeated mysqld crash-and-restart cycles within short time windows, which indicate exploitation attempts rather than isolated failures.
Track authentication events for administrative and application service accounts to detect credential misuse.
Monitor host-level resource metrics for spikes in CPU or memory attributable to the MySQL process.

How to Mitigate CVE-2025-53067

Immediate Actions Required

Apply the Oracle Critical Patch Update October 2025 to all MySQL Server instances running versions 9.0.0 through 9.4.0.
Audit accounts holding high database privileges and remove entitlements that are not required for operations.
Rotate credentials for any high-privileged database account that has been shared, exposed, or used outside its intended application.
Restrict network access to MySQL Server to trusted application hosts using firewall rules or security groups.

Patch Information

Oracle published fixes in the October 2025 Critical Patch Update. Administrators should review the Oracle Critical Patch Update October 2025 advisory and upgrade MySQL Server to a fixed release after 9.4.0. Test the patch in a non-production environment before rolling out to production databases.

Workarounds

Enforce least privilege for all database accounts to reduce the population of users capable of triggering the vulnerability.
Terminate direct database access from developer workstations and require access through audited bastion hosts.
Configure max_execution_time and connection-level resource limits to reduce the impact of long-running or resource-intensive queries.
Place MySQL Server behind a database proxy or firewall that can rate-limit query volume from individual accounts.

bash

# Restrict MySQL network exposure and enforce query timeout (example)
# In my.cnf on the database host:
[mysqld]
bind-address = 10.0.0.25
max_execution_time = 30000   # 30 seconds, in milliseconds

# Revoke unnecessary high privileges from an application account:
mysql> REVOKE SUPER, PROCESS, RELOAD ON *.* FROM 'app_user'@'10.0.0.%';
mysql> FLUSH PRIVILEGES;