CVE-2025-21529 - Vulnerability Details

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Oracle	Mysql Server
Redhat	Enterprise Linux

Configuration 1 [-]

OR	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:mysql_server::::::::
	cpe:2.3:a:oracle:mysql_server::::::::

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
mysql:8.0-8100020250212154709.489197e6	cpe:/a:redhat:enterprise_linux:8	RHSA-2025:1673	2025-02-19T00:00:00Z
Red Hat Enterprise Linux 9
mysql-0:8.0.41-2.el9_5	cpe:/a:redhat:enterprise_linux:9	RHSA-2025:1671	2025-02-19T00:00:00Z

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2025-21529
https://www.cve.org/CVERecord?id=CVE-2025-21529
https://www.oracle.com/security-alerts/cpujan2025.html
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL

History

Tue, 08 Apr 2025 21:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:oracle:mysql_server::::::::

Mon, 24 Mar 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400

Thu, 20 Feb 2025 02:45:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:enterprise_linux:8

Wed, 19 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

Tue, 18 Feb 2025 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-770

Sat, 25 Jan 2025 01:45:00 +0000

Type	Values Removed	Values Added
Title		mysql: Information Schema unspecified vulnerability (CPU Jan 2025)
References		https://nvd.nist.gov/vuln/detail/CVE-2025-21529 https://www.cve.org/CVERecord?id=CVE-2025-21529 https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 22 Jan 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 21 Jan 2025 21:00:00 +0000

Type	Values Removed	Values Added
Description		Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared		Oracle Oracle mysql Server
CPEs		cpe:2.3:a:oracle:mysql_server:8.0.40_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:8.4.3_and_prior:::::::* cpe:2.3:a:oracle:mysql_server:9.1.0_and_prior:::::::*
Vendors & Products		Oracle Oracle mysql Server
References		https://www.oracle.com/security-alerts/cpujan2025.html
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2025-01-21T20:53:07.906Z

Updated: 2025-03-24T17:41:33.208Z

Reserved: 2024-12-24T23:18:54.770Z

Link: CVE-2025-21529

Vulnrichment

Updated: 2025-01-22T18:10:18.545Z

NVD

Status : Analyzed

Published: 2025-01-21T21:15:18.720

Modified: 2025-04-08T20:44:21.260

Link: CVE-2025-21529

Redhat

Severity : Moderate

Publid Date: 2025-01-21T20:53:07Z

Links: CVE-2025-21529 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-21529", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2024-12-24T23:18:54.770Z", "datePublished": "2025-01-21T20:53:07.906Z", "dateUpdated": "2025-03-24T17:41:33.208Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2025-01-21T20:53:07.906Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "MySQL Server", "cpes": ["cpe:2.3:a:oracle:mysql_server:8.0.40_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_server:8.4.3_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_server:9.1.0_and_prior:*:*:*:*:*:*:*"], "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "8.0.40", "versionType": "custom"}, {"version": "*", "status": "affected", "lessThanOrEqual": "8.4.3", "versionType": "custom"}, {"version": "*", "status": "affected", "lessThanOrEqual": "9.1.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2025.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-22T18:09:49.695440Z", "id": "CVE-2025-21529", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T17:41:33.208Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21529", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-22T18:09:49.695440Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-22T18:10:18.545Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:2.3:a:oracle:mysql_server:8.0.40_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_server:8.4.3_and_prior:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:mysql_server:9.1.0_and_prior:*:*:*:*:*:*:*"], "vendor": "Oracle Corporation", "product": "MySQL Server", "versions": [{"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "8.0.40"}, {"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "8.4.3"}, {"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "9.1.0"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2025.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2025-01-21T20:53:07.906Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21529", "state": "PUBLISHED", "dateUpdated": "2025-03-24T17:41:33.208Z", "dateReserved": "2024-12-24T23:18:54.770Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2025-01-21T20:53:07.906Z", "assignerShortName": "oracle"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF091998-B545-474D-A31F-ED2C971AA64A", "versionEndIncluding": "8.0.40", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B10E8F6D-041F-410A-90BA-461AD19DB569", "versionEndIncluding": "8.4.3", "versionStartIncluding": "8.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE5CCDEC-E9CF-4D97-AA17-39DF462918AB", "versionEndIncluding": "9.1.0", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto MySQL Server de Oracle MySQL (componente: Server: Information Schema). Las versiones compatibles afectadas son 8.0.40 y anteriores, 8.4.3 y anteriores y 9.1.0 y anteriores. Esta vulnerabilidad, que se puede explotar f\u00e1cilmente, permite que un atacante con privilegios elevados y acceso a la red a trav\u00e9s de m\u00faltiples protocolos ponga en peligro MySQL Server. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado la capacidad no autorizada de provocar un bloqueo o un bloqueo frecuente y repetible (DOS completo) de MySQL Server. Puntuaci\u00f3n base de CVSS 3.1: 4,9 (impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}], "id": "CVE-2025-21529", "lastModified": "2025-04-08T20:44:21.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "secalert_us@oracle.com", "type": "Secondary"}]}, "published": "2025-01-21T21:15:18.720", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpujan2025.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:1673", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "mysql:8.0-8100020250212154709.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-02-19T00:00:00Z"}, {"advisory": "RHSA-2025:1671", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "mysql-0:8.0.41-2.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-02-19T00:00:00Z"}], "bugzilla": {"description": "mysql: Information Schema unspecified vulnerability (CPU Jan 2025)", "id": "2339226", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."], "name": "CVE-2025-21529", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "mysql", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2025-01-21T20:53:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21529\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21529\nhttps://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL"], "threat_severity": "Moderate"}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object