CVE-2025-50096

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with log-on access to the infrastructure where MySQL Server runs to cause a crash in the MySQL server.

A moderate severity denial of service flaw was found in the InnoDB component of MySQL Server, affecting the mysql packages in Red Hat Enterprise Linux 8, 9, and 10 and the mysql8.0 and mysql8.4 packages in Fedora. A high-privileged attacker with log-on access to the infrastructure where MySQL Server executes could exploit this easily exploitable flaw to cause the MySQL server to hang or crash repeatedly, resulting in a complete denial of service of MySQL Server; only availability is impacted. For the affected Red Hat Enterprise Linux releases a fix is being pursued through Red Hat's regular update channels. For Fedora, the fix is deferred to the community maintenance process that follows upstream MySQL releases, and those package streams remain exposed to the availability impact until an updated version is shipped. The mysql package in Red Hat Enterprise Linux 6 Extended Life Cycle Support is not affected because the vulnerable code is not present in that version. Red Hat assigns a CVSS 3.1 base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, Moderate), which closely matches the upstream Oracle score of 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, Medium).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.