CVE-2022-21640 in MySQL Server
Summary
by MITRE • 10/19/2022
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability identified as CVE-2022-21640 represents a critical availability risk within Oracle MySQL Server's optimizer component, affecting versions 8.0.30 and earlier. This flaw resides in the server's query optimization logic where specific conditions can trigger abnormal behavior leading to system instability. The vulnerability operates at a fundamental level within the database engine's processing pipeline, specifically targeting how the optimizer handles certain query execution paths that can result in resource exhaustion or internal state corruption.
The technical nature of this vulnerability stems from improper handling of memory allocation and execution flow within the MySQL Server's optimizer module. When specific query patterns are processed, the optimizer fails to properly manage memory resources or handle edge cases in query planning, leading to conditions that can cause the server to become unresponsive or crash entirely. This issue manifests as a denial of service condition where legitimate database operations are disrupted, and the server enters a state where it cannot properly process subsequent requests.
From an operational perspective, this vulnerability presents a significant risk to database availability and system reliability. The CVSS score of 4.9 indicates a moderate to high impact on availability, with the potential for complete system downtime. The attack vector requires only network access from a high-privileged user, making it particularly dangerous in environments where administrative access is not properly restricted. Successful exploitation results in a complete denial of service condition that can persist until manual intervention or server restart occurs, potentially disrupting critical business operations and data access.
The vulnerability's impact extends beyond simple service disruption as it can lead to extended downtime that affects business continuity and data availability. Organizations relying on MySQL for critical applications face potential revenue loss and operational disruption when this vulnerability is exploited. The flaw affects the server's ability to maintain consistent operation under normal load conditions, making it particularly concerning for production environments where database uptime is critical. Recovery from such an attack typically requires manual intervention and system restart, adding to the operational burden and potential for extended service interruption.
Organizations should implement immediate mitigation strategies including applying the relevant Oracle security patches and updates to affected MySQL Server installations. Network segmentation and access controls should be reinforced to limit the attack surface, ensuring that only authorized administrative users have access to the database server. Monitoring systems should be enhanced to detect unusual patterns of database activity or connection behavior that might indicate exploitation attempts. Additionally, implementing database activity monitoring and alerting mechanisms can help detect when the optimizer component is being exercised in ways that could trigger the vulnerability, allowing for proactive response measures before complete system compromise occurs. This vulnerability aligns with CWE-476 which addresses null pointer dereference conditions and ATT&CK technique T1499 for network denial of service attacks, highlighting the need for comprehensive security posture management.