CVE-2025-21521: oracle corporation mysql server

CVSS: 7.5v3.1HighModified

AliasesRHBA-2025:5321RHSA-2025:1755RHSA-2025:1756+6 more

Published 21-01-2025Last modified 03-11-2025

Vulnerability summary

CVE-2025-21521 is a high (CVSS 7.5) vulnerability in oracle corporation mysql server. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 65.7% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

1.12%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2025:1671 RHSA-2025:1673

Timeline

21-01-2025
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

1.12%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

0.00 pp

From 1.12% on 20-09-2026

20-09-202620-10-2026

EPSS score

1.12%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Redhat33 products

mecab< 0:0.996-2.module+el8.8.0+18436+8918dd75 | < 0:0.996-2.module+el8.6.0+16523+5cb0e868 | < 0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debuginfo< 0:0.996-2.module+el8.8.0+18436+8918dd75 | < 0:0.996-2.module+el8.6.0+16523+5cb0e868 | < 0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-debugsource< 0:0.996-2.module+el8.8.0+18436+8918dd75 | < 0:0.996-2.module+el8.6.0+16523+5cb0e868 | < 0:0.996-1.module+el8.0.0+3898+e09bb8de.9
mecab-devel< 0:0.996-2.module+el8.8.0+18436+8918dd75
mecab-ipadic< 0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de

mecab-ipadic-EUCJP< 0:2.7.0.20070801-16.module+el8.0.0+3898+e09bb8de
mysql< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-common< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-debuginfo< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-debugsource< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-devel< 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-devel-debuginfo< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-errmsg< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-libs< 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-libs-debuginfo< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-server< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-server-debuginfo< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-test< 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql-test-debuginfo< 0:8.0.40-2.el9_0 | < 0:8.0.40-1.el9_4 | < 0:8.0.40-1.module+el8.8.0+22863+a1071e1e | < 0:8.0.40-1.module+el8.6.0+22864+ceaef991 | < 0:8.0.40-1.el9_2.1 | < 0:8.0.40-1.module+el8.4.0+22899+4f2ca788.1 | < 0:8.0.40-1.module+el8.2.0+22898+0bdd8c5b.4
mysql8.4< 0:8.4.4-2.el10
mysql8.4-common< 0:8.4.4-2.el10
mysql8.4-debuginfo< 0:8.4.4-2.el10
mysql8.4-debugsource< 0:8.4.4-2.el10
mysql8.4-devel< 0:8.4.4-2.el10
mysql8.4-devel-debuginfo< 0:8.4.4-2.el10
mysql8.4-errmsg< 0:8.4.4-2.el10
mysql8.4-libs< 0:8.4.4-2.el10
mysql8.4-libs-debuginfo< 0:8.4.4-2.el10
mysql8.4-server< 0:8.4.4-2.el10
mysql8.4-server-debuginfo< 0:8.4.4-2.el10
mysql8.4-test< 0:8.4.4-2.el10
mysql8.4-test-data< 0:8.4.4-2.el10
mysql8.4-test-debuginfo< 0:8.4.4-2.el10

Show all 33

Ubuntu5 products

mysql-5.5All versions (No fix recorded)
mysql-5.7All versions (No fix recorded)
mysql-8.0< 8.0.40-0ubuntu0.20.04.1 | < 8.0.40-0ubuntu0.22.04.1 | < 8.0.40-0ubuntu0.24.04.1
percona-server-5.6All versions (No fix recorded)
percona-xtradb-cluster-5.6All versions (No fix recorded)

Oracle1 product

mysql_server≥ 8.0.0, ≤ 8.0.39 | ≥ 8.4.0, ≤ 8.4.2 | ≥ 9.0.0, ≤ 9.0.1

Oracle corporation1 product

mysql server≤ 8.0.39 | ≤ 8.4.2 | ≤ 9.0.1

4 vendors · 40 products

References

27 links

www.oracle.com/security-alerts/cpujan2025.htmlVendor AdvisoryREPORT
security.netapp.com/advisory/ntap-20250124-0010/
access.redhat.com/errata/RHBA-2025:5321Advisory
docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/indexARTICLE
issues.redhat.com/browse/RHEL-79549ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_5321.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-21521REPORT
bugzilla.redhat.com/show_bug.cgi?id=2339270REPORT
www.cve.org/CVERecord?id=CVE-2025-21521AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2025-21521AdvisoryOval

Show all 27 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities