CVE-2025-50088

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

A MODERATE severity vulnerability was found in the InnoDB component of Oracle MySQL Server, affecting versions 8.0.0-8.0.41, 8.4.0-8.4.4, and 9.0.0-9.2.0. The flaw is easily exploitable and allows a high privileged attacker with network access via multiple protocols to cause a hang or frequently repeatable crash (complete denial of service) of MySQL Server. Only availability is impacted; there is no impact to confidentiality or integrity (CVSS 3.1 score 4.9, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Red Hat rates this flaw MODERATE, which is consistent with the upstream Oracle severity.

In Red Hat Enterprise Linux, the mysql packages and the mysql:8.0 and mysql:8.4 module streams in RHEL 8, 9, and 10 are affected, and fixes are being pursued through the respective update streams. The mysql package in RHEL 6 Extended Lifecycle Support is not affected because the vulnerable code is not present. The flaw also affects the mysql packages in Fedora and Red Hat In-Vehicle OS: for the Fedora mysql 8.0 package the fix is deferred and tracked only for Rawhide, so installations on stable Fedora releases remain exposed to denial of service until the update is delivered; for Red Hat In-Vehicle OS 1.0 a fix will not be provided (delegated WONTFIX), leaving affected deployments with residual risk of a complete denial of service by a privileged user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users should apply the updated mysql packages through their respective Red Hat or Fedora update channels when they become available for their release.