CVE-2022-21638 in MySQL Server
Summary
by MITRE • 10/19/2022
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability identified as CVE-2022-21638 resides within the MySQL Server optimizer component of Oracle MySQL, affecting versions 8.0.29 and earlier. This flaw represents a significant security concern as it operates within the core database engine's query optimization logic, which is fundamental to database operations. The vulnerability's classification as easily exploitable indicates that attackers with high privileges and network access can leverage this weakness to compromise the target system. The CVSS score of 4.9 reflects the availability impact, specifically the potential for complete denial of service through hang conditions or repeated crashes, making this a critical concern for database availability.
The technical nature of this vulnerability stems from issues within the server's optimizer module, which is responsible for determining the most efficient execution plan for database queries. When an attacker with sufficient privileges can manipulate specific query patterns or data structures, the optimizer may enter into a state that causes the MySQL server process to become unresponsive or crash repeatedly. This occurs because the optimizer's internal logic fails to properly handle certain edge cases or malicious inputs, leading to resource exhaustion or invalid memory access patterns. The vulnerability's impact extends beyond simple query execution as it affects the fundamental operational stability of the database server, potentially causing cascading failures in applications dependent on the database service.
Operational implications of this vulnerability are severe for organizations relying on MySQL Server for critical database operations. The ability to cause complete denial of service through hang conditions or frequent crashes can result in significant business disruption, particularly in environments where database availability is paramount for application functionality. The high privilege requirement for exploitation means that attackers typically need to have legitimate access to the system with elevated permissions, which could indicate either compromised administrative accounts or insider threats. Organizations may experience extended downtime while investigating and resolving the service disruptions caused by this vulnerability, potentially leading to data loss, service interruptions, and financial impact from reduced productivity.
Mitigation strategies for CVE-2022-21638 primarily focus on immediate patching of affected MySQL Server installations to versions that address the optimizer flaw. Organizations should prioritize updating their MySQL Server instances to versions that include the security fixes released by Oracle, as these updates contain the necessary code modifications to prevent the optimizer from entering problematic states. Network segmentation and access controls should be implemented to limit the attack surface, ensuring that only authorized personnel have high-privilege access to the database server. Monitoring systems should be enhanced to detect unusual patterns of database server crashes or hangs that might indicate exploitation attempts. Additionally, organizations should implement regular security assessments and vulnerability scanning to identify other potential weaknesses in their database infrastructure. This vulnerability aligns with CWE-121, which describes heap-based buffer overflow conditions, and may map to ATT&CK technique T1499.004 for network denial of service attacks, highlighting the importance of maintaining robust database security practices and continuous vulnerability management programs.