CVE-2025-50078

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

A moderate severity vulnerability was found in the MySQL Server (Server: DML) component of Oracle MySQL, affecting the mysql and mysql8.4 packages as shipped in Red Hat Enterprise Linux 8, 9, and 10, the mysql component in Red Hat In-Vehicle OS 1, and the mysql8.0 and mysql8.4 packages in Fedora. This easily exploitable flaw allows a remote, authenticated attacker with low privileges and network access via multiple protocols to cause a hang or frequently repeatable crash, resulting in a complete denial of service of the MySQL server. The mysql package in Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that version. Red Hat rated this flaw as MODERATE impact with a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which matches the upstream Oracle rating, so there is no meaningful difference from upstream severity. For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS components, remediation is delegated to the component maintainers and a fix is being pursued through the standard update process. For Fedora, the fix is deferred and resolved in Rawhide only, leaving released Fedora versions with residual risk of denial of service by authenticated low-privileged users until updated packages become available.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users of affected products should install the updated mysql packages as they become available through their respective update channels.