CVE-2022-21436 in MySQL Server
Summary
by MITRE • 04/20/2022
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/18/2025
The vulnerability identified as CVE-2022-21436 resides within the MySQL Server optimizer component of Oracle MySQL, specifically affecting versions 8.0.28 and earlier. This designation places the flaw within the broader category of database server optimization functionality that handles query execution planning and resource allocation. The vulnerability operates at a fundamental level where the server's query optimizer fails to properly handle certain complex query structures, leading to potential system instability. The affected component is classified under CWE-248, which represents "Uncaught Exception" in software security contexts, indicating that the system does not properly manage exceptional conditions during query processing.
The technical nature of this vulnerability manifests when high-privileged attackers exploit specific query patterns that trigger improper memory handling or resource management within the optimizer module. The flaw allows attackers with network access and elevated privileges to craft malicious queries that cause the MySQL server to enter a state of continuous resource exhaustion or deadlock conditions. This results in complete denial of service scenarios where the server becomes unresponsive and requires manual intervention to restore functionality. The vulnerability's exploitability is rated as easily accessible due to the combination of network accessibility and the requirement for only high-privileged accounts, which typically possess administrative or root-level database permissions. The CVSS 3.1 scoring of 4.9 reflects the availability impact, with the vector indicating network access (AV:N), low attack complexity (AC:L), high privilege requirements (PR:H), and no user interaction needed (UI:N).
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise entire database infrastructure availability. Organizations running affected MySQL versions face significant risk of operational downtime, which can cascade into broader business continuity issues depending on their database dependency levels. The vulnerability's potential to cause repeated crashes makes it particularly dangerous in production environments where database uptime is critical for business operations. Attackers can repeatedly execute the malicious queries to maintain persistent denial of service conditions, making this a particularly concerning threat for database administrators and security operations teams. The complete system crash capability means that even automated failover mechanisms may be overwhelmed by the continuous nature of the attack vector.
Mitigation strategies for CVE-2022-21436 should prioritize immediate patching of affected MySQL server instances to version 8.0.29 or later, which contains the necessary fixes for the optimizer flaw. Network segmentation and access controls should be implemented to limit the attack surface, ensuring that only authorized high-privileged accounts can access the database server. Database administrators should monitor for unusual query patterns and implement query timeouts to prevent long-running operations from consuming excessive resources. Additionally, implementing intrusion detection systems that can identify suspicious query behavior and establishing regular backup procedures for rapid recovery are essential defensive measures. The vulnerability aligns with ATT&CK technique T1499.004, which covers "Cloud Service Configuration Vulnerability" and represents a critical weakness in database server security that can be exploited to disrupt service availability. Organizations should also consider implementing database activity monitoring solutions that can detect and alert on potentially malicious query patterns before they can cause system instability.