CVE-2025-21574 Details
Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
A denial-of-service vulnerability has been identified in the MySQL Server product of Oracle MySQL, specifically within the Server: Parser component. This issue affects versions 8.0.0 through 8.0.41, 8.4.0 through 8.4.4, and 9.0.0 through 9.2.0. The vulnerability is easily exploitable, allowing a low-privileged attacker with network access via multiple protocols to disrupt MySQL Server operations. Successful exploitation can lead to unauthorized actions causing the server to hang or crash frequently, resulting in a complete denial-of-service condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20250502-0006/ | CVE | |
| https://www.oracle.com/security-alerts/cpuapr2025.html | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| oracle mysql cluster | >= 7.6.0, <= 7.6.33 >= 8.0.0, <= 8.0.41 >= 8.4.0, <= 8.4.4 >= 9.0.0, <= 9.2.0 |
CPE
Remediation
| |
| oracle mysql server | >= 8.0.0, <= 8.0.41 >= 8.4.0, <= 8.4.4 >= 9.0.0, <= 9.2.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | CVE Modified | CVE |
| Apr 17, 2025 | Initial Analysis | [email protected] |
| Apr 16, 2025 | CVE Modified | CISA-ADP |
| Apr 15, 2025 | New CVE Received | [email protected] |