CVE-2025-53023

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.42. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

A moderate impact denial-of-service vulnerability was found in the Replication component of the MySQL Server product of Oracle MySQL, affecting the mysql packages shipped in Red Hat Enterprise Linux 8 and 9. A remote attacker with high privileges and network access via multiple protocols could exploit this flaw to cause a hang or frequently repeatable crash (complete denial of service) of the MySQL Server; there is no impact to confidentiality or integrity. Upstream, this issue affects MySQL Server versions 8.0.0-8.0.42.

Within Red Hat's affected scope, the mysql:8.0 module in Red Hat Enterprise Linux 8 and the mysql component in Red Hat Enterprise Linux 9 are affected, and a fix has been pursued through the delegated update process with updated packages released for those streams. The mysql:8.4 streams in Red Hat Enterprise Linux 9, mysql8.4 in Red Hat Enterprise Linux 10, and mysql in Red Hat Enterprise Linux 6 Extended Lifecycle Support are not affected because the vulnerable code is not present in those MySQL 8.4-based components. For Fedora, the community maintainers deferred the mysql8.0 update, so residual risk remains for users of affected MySQL 8.0 versions on stable Fedora releases. The Red Hat severity matches upstream: both use a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, moderate).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updated mysql packages that address this issue have been released for the affected Red Hat Enterprise Linux streams; installing the latest available package updates resolves the issue.