CVE-2025-50100

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

A low impact vulnerability was found in the MySQL Server Thread Pooling component of Oracle MySQL. This flaw is difficult to exploit and requires an attacker to already hold high privileges and to have network access via multiple protocols; successful exploitation can result in a partial denial of service of the MySQL server, with no impact to confidentiality or integrity. Red Hat rates this flaw as LOW impact, matching the upstream CVSS 3.1 base score of 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L). The mysql packages in Red Hat Enterprise Linux 8, 9, and 10 are affected, and a fix is being pursued for these streams through the delegated update process. mysql in Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that release. In Fedora, the community-maintained mysql 8.0 and mysql 8.4 packages are affected and the fix is currently deferred; the residual risk is limited to a partial denial of service that requires a highly privileged attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Applying updated mysql packages for affected Red Hat Enterprise Linux streams, delivered through the respective Red Hat update channels, addresses this issue.