CVE-2025-21575 in MySQL Cluster
Summary
by MITRE • 04/16/2025
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2025
The vulnerability identified as CVE-2025-21575 resides within the MySQL Server component known as the Server: Parser, representing a critical availability threat that affects multiple version ranges including 8.0.0 through 8.0.41, 8.4.0 through 8.4.4, and 9.0.0 through 9.2.0. This flaw manifests as an easily exploitable weakness that requires minimal privileges and can be initiated through network-based attacks across various protocols. The security implications extend beyond simple data access as the vulnerability enables attackers to induce complete denial of service conditions by causing server hangs or repeated crashes that effectively render the database unavailable to legitimate users.
The technical nature of this vulnerability lies within the parser component of MySQL Server which processes incoming SQL queries and commands. When malformed or specially crafted inputs are processed through this parser, the underlying code fails to properly validate or handle certain edge cases, leading to memory corruption or execution flow disruptions. This parser failure creates a condition where the server becomes unresponsive or enters an infinite loop, ultimately resulting in the complete system crash that can be repeatedly triggered by an attacker. The vulnerability's classification as CVSS 3.1 Base Score 6.5 indicates a moderate to high severity threat with availability impacts being the primary concern.
From an operational perspective, this vulnerability presents significant risks to database availability and business continuity. Organizations running affected MySQL versions face potential downtime that could impact critical applications relying on database services, particularly those in financial services, healthcare, or e-commerce sectors where database unavailability can result in substantial revenue loss and customer dissatisfaction. The low privilege requirement and network accessibility mean that even casual attackers can exploit this vulnerability without requiring administrative credentials or physical access to the system, making it particularly dangerous in multi-tenant environments or cloud deployments where network exposure is common.
The attack surface expands due to the multiple protocol support that enables exploitation, suggesting that attackers can leverage various communication channels including TCP/IP connections, named pipes, or other network interfaces that MySQL supports. This vulnerability directly maps to CWE-121, which describes stack-based buffer overflow conditions, and aligns with ATT&CK technique T1499.004 for network denial of service attacks. Organizations should implement immediate mitigations including applying the latest security patches from Oracle, implementing network segmentation to limit access to MySQL services, and deploying intrusion detection systems to monitor for suspicious network traffic patterns that may indicate exploitation attempts.
The impact of this vulnerability extends beyond immediate service disruption as it can also affect database replication systems, backup operations, and automated monitoring tools that depend on stable database connectivity. Security teams should conduct comprehensive vulnerability assessments across their MySQL deployments to identify affected versions and prioritize patching efforts. Additionally, implementing proper access controls and network firewalls to restrict MySQL server access to trusted networks can provide temporary protection while permanent fixes are deployed. The CVSS vector analysis indicates that no user interaction is required for exploitation, making this vulnerability particularly concerning for organizations with exposed database servers on public networks where such attacks can be launched from anywhere in the world.