Loading vulnerability…
Denial of Service in Oracle MySQL Server DDL
CVE-2025-21525 is an unspecified vulnerability in the Data Definition Language (DDL) component of Oracle MySQL Server. MySQL Server versions 8.0.39 and earlier, 8.4.2 and earlier, and 9.0.1 and earlier are affected. A high-privileged attacker with network access through multiple protocols can exploit the flaw to hang or repeatedly crash the MySQL Server process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a MySQL Server hang or a frequently repeatable complete crash, resulting in denial of service and loss of database availability.
If you can’t patch tonight, do this now.
No specific temporary workaround is identified. Until patches can be applied, restrict network access to MySQL Server, limit high-privilege database accounts to trusted administrators, and monitor for anomalous activity that may cause repeated server hangs or crashes.
Patch, then assume compromise.
Install Oracle's January 2025 Critical Patch Update or a later MySQL Server release that includes the fix. For Red Hat Enterprise Linux 8 deployments using the MySQL 8.0 module, apply RHSA-2025:1673, which rebases MySQL to 8.0.41.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.