Loading vulnerability…
Denial of Service in Oracle MySQL Server Privileges
CVE-2025-21519 is a vulnerability in the Server: Security: Privileges component of Oracle MySQL Server. It affects MySQL Server versions 8.0.40 and earlier, 8.4.3 and earlier, and 9.1.0 and earlier. A high-privileged attacker with network access through multiple protocols can exploit the flaw to compromise MySQL Server availability, causing a hang or a frequently repeatable complete crash.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can render the MySQL Server unavailable by causing a hang or a frequently repeatable complete crash, resulting in complete denial of service.
If you can’t patch tonight, do this now.
No specific temporary workaround is identified. Until updates can be applied, restrict MySQL network exposure to trusted hosts and protocols, minimize the number of accounts with high privileges, and monitor for abnormal MySQL service hangs or repeated crashes.
Patch, then assume compromise.
Apply Oracle security updates for the January 2025 Critical Patch Update, or update MySQL Server to a vendor-fixed release later than the affected version lines.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.