CVE-2025-50082

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

A moderate severity denial of service vulnerability was found in the MySQL Server Optimizer. A remote, low-privileged attacker with network access via multiple protocols could exploit this flaw to cause the MySQL Server to hang or crash in a frequently repeatable manner, resulting in a complete denial of service of the affected MySQL Server. Only availability is impacted; confidentiality and integrity are not affected. Red Hat rates this flaw Moderate severity with a CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), consistent with the upstream Oracle rating. The upstream advisory states that Oracle MySQL Server 8.0.0-8.0.42, 8.4.0-8.4.5, and 9.0.0-9.3.0 are affected.

In Red Hat Enterprise Linux, the mysql packages and the mysql:8.0 and mysql:8.4 modules in RHEL 8, 9, and 10 are affected, and a fix is being pursued through delegated updates that track the upstream Oracle MySQL releases. mysql in Red Hat Enterprise Linux 6 Extended Life Cycle Support is not affected because the vulnerable code is not present in that build. mysql in Red Hat In-Vehicle OS 1.1 is not affected according to the delegated assessment. In Fedora, mysql8.0 and mysql8.4 are affected, but the fix is currently deferred to a future update, leaving a residual risk that an authenticated low-privileged user could hang or crash the MySQL server until updated packages are delivered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.