CVE-2025-50097

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

A moderate severity vulnerability was found in the Server: Security: Encryption component of Oracle MySQL Server. An easily exploitable flaw allows a high privileged attacker with network access via multiple protocols to compromise MySQL Server; successful attacks can result in an unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of MySQL Server. Oracle reported affected versions 8.0.0-8.0.42, 8.4.0-8.4.5, and 9.0.0-9.3.0. Red Hat rated this flaw Moderate impact with a CVSS 3.1 base score of 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), matching the upstream severity, because exploitation requires high privileges and only availability is impacted. The mysql, mysql:8.0, and mysql:8.4 components in Red Hat Enterprise Linux 8, 9, and 10 are affected, and fixes are being pursued for those releases. The mysql package in Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that version. The mysql component in Red Hat In-Vehicle OS is also recorded as affected. For the Fedora community packages mysql8.0 and mysql8.4, the fix is deferred; until updated packages are delivered, the residual risk remains that a high privileged attacker could cause complete denial of service of the MySQL server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users of affected Red Hat Enterprise Linux releases should apply the mysql package updates available for their release, which contain the fix for this issue.