PT-2024-10252 · Oracle+6 · Mysql Server+5

Published 2024-12-25 · Updated 2025-05-19 · CVE-2025-21504

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.39 and prior MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior

Description The issue is related to insufficient input validation in the Server: Optimizer component of Oracle MySQL Server. This can be exploited by a remote attacker to cause a denial of service. Successful attacks can result in the unauthorized ability to cause a hang or frequently repeatable crash of MySQL Server.

Recommendations For MySQL Server versions 8.0.39 and prior, update to a version that includes the fix for this issue. For MySQL Server versions 8.4.2 and prior, update to a version that includes the fix for this issue. For MySQL Server versions 9.0.1 and prior, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Server: Optimizer component until a patch is available.

Fix

DoS

Improper Resource Release

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-404

CWE-770

CWE-20

Related Identifiers

ALSA-2025:1671

ALSA-2025:1673

ALT-PU-2025-2529

ALT-PU-2025-2654

ALT-PU-2025-6390

BDU:2025-00649

CESA-2025_1673

CVE-2025-21504

INFSA-2025_1671

INFSA-2025_1673

RHSA-2025:1671

RHSA-2025:1673

RHSA-2025_1671

RHSA-2025_1673

RLSA-2025:1671

RLSA-2025:1673

Affected Products

Alt Linux

Almalinux

Centos

Mysql Server

Red Hat

Rocky Linux

References · 172

• https://ubuntu.com/security/CVE-2025-21504 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-1673.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-21504 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2025:1671 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:1671 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:1671 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-1671.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-21504 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2025:1673 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-1673.html · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-1671.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21504 · Security Note
• https://oracle.com/security-alerts/cpujan2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00649 · Security Note
• https://osv.dev/vulnerability/ALSA-2025:1673 · Vendor Advisory