CVE-2022-21342 in MySQL Server
Summary
by MITRE • 01/19/2022
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/17/2025
The vulnerability identified as CVE-2022-21342 resides within the MySQL Server optimizer component of Oracle MySQL, affecting versions 8.0.27 and earlier. This issue represents a significant availability threat that can be exploited by attackers with high privileges and network access through multiple protocols. The vulnerability operates at the core optimization layer of the database server, where query execution planning occurs, making it particularly dangerous as it can disrupt fundamental database operations. The CVSS score of 4.9 indicates a moderate to high severity impact, with the primary concern being the potential for complete denial of service conditions that can either hang the server or cause repeated crashes, effectively rendering the database unavailable to legitimate users.
The technical flaw manifests within the server's query optimization logic where specific conditions can trigger abnormal behavior in the optimizer module. This vulnerability allows an attacker with elevated privileges to craft malicious queries or manipulate existing database operations in ways that cause the MySQL server process to become unresponsive or crash repeatedly. The exploitation requires network access and high privilege levels, suggesting that the attack vector likely involves authenticated database connections with administrative or sufficient access rights. The optimizer component is responsible for determining the most efficient execution plan for database queries, and when this component fails, it can cascade into system-wide availability issues that affect all database operations.
From an operational impact perspective, this vulnerability creates a complete denial of service scenario that can severely disrupt database services and business operations. When the MySQL server experiences hangs or frequent crashes, database applications that depend on the server become unavailable, potentially causing widespread service degradation or complete system outages. The vulnerability's ability to cause repeated crashes makes it particularly problematic for environments where database availability is critical, as administrators may face ongoing service interruptions that require manual intervention to restore normal operations. Organizations using affected MySQL versions face significant risk of operational disruption, especially in mission-critical applications where database uptime is essential for business continuity.
The vulnerability aligns with CWE-472 Unpredictable Behavior in the Optimizer and can be categorized under ATT&CK technique T1499.004 for Network Denial of Service. Mitigation strategies should prioritize immediate patching of affected MySQL server installations to version 8.0.28 or later where the vulnerability has been addressed. Organizations should also implement network segmentation and access controls to limit the attack surface, ensuring that only authorized administrative users have the necessary privileges to access database servers. Additionally, monitoring and logging should be enhanced to detect unusual patterns in database query execution that might indicate exploitation attempts, while regular backup and recovery procedures should be maintained to minimize impact during potential exploitation events.