CVE-2025-50098

A denial of service flaw was found in MySQL. This flaw allows a privileged attacker with network access via multiple protocols to cause a crash in the MySQL server.

A low severity denial of service flaw was found in the MySQL Server Optimizer component of Oracle MySQL, affecting the MySQL 8.0 and 8.4 packages shipped in Red Hat Enterprise Linux 8, 9, and 10. A high-privileged attacker with network access via multiple protocols could exploit this flaw to cause a crash of the MySQL server, resulting in a partial denial of service. The vulnerability was addressed upstream by Oracle in the July 2025 Critical Patch Update, and fixes for the affected Red Hat Enterprise Linux releases are being pursued through the delegated upstream MySQL maintenance releases. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in the MySQL version it ships. Community Fedora releases also ship affected MySQL 8.0 and 8.4 packages, but fixes for those are deferred to the Fedora community update process, so the low severity denial-of-service exposure remains until community updates are applied. The Red Hat severity aligns with the upstream assessment: CVSS 3.1 base score 2.7 (LOW), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.