Vulnerability in MySQL Server by Oracle Affecting Version 8.0.40 and Earlier
CVE-2025-21501

6.5MEDIUM

Key Information:

Vendor
Oracle
Status
Mysql Server
Vendor
CVE Published:
21 January 2025

Summary

A vulnerability exists in MySQL Server from Oracle affecting supported versions up to 8.0.40, 8.4.3, and 9.1.0. This flaw can be exploited by a low-privileged attacker with network access through various protocols. Successful exploitation enables the attacker to induce a hang or repeated crashes of the MySQL Server, ultimately leading to a denial of service. The impact on availability can disrupt services reliant on MySQL databases, compromising operational integrity.

Affected Version(s)

MySQL Server * <= 8.0.40

MySQL Server * <= 8.4.3

MySQL Server * <= 9.1.0

References

https://www.oracle.com/security-alerts/cpujan2025.html
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.