CVE-2025-53044

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

A moderate-impact denial-of-service vulnerability was found in the InnoDB component of MySQL Server, affecting the mysql packages provided in Red Hat Enterprise Linux, Fedora, and Red Hat In-Vehicle OS. The flaw is easily exploitable by a remote attacker who has authenticated to the MySQL server with high privileges and has network access via multiple protocols; successful exploitation can cause the MySQL server to hang or crash frequently and repeatedly, resulting in a complete denial of service. Confidentiality and integrity are not affected. This issue has been rated as Moderate by Red Hat Product Security, with a CVSS 3.1 score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), consistent with the upstream Oracle severity rating. The mysql packages in Red Hat Enterprise Linux 8, 9, and 10 are affected, and fixes are being pursued through the delegated maintenance process, with updates delivered through the respective update channels. The mysql package in Red Hat Enterprise Linux 6 Extended Life Cycle Support is not affected because the vulnerable code is not present. For Red Hat In-Vehicle OS, the mysql component is tracked as affected with its resolution delegated; the delegated platform team has assessed it as not affected. In Fedora, the mysql8.4 package is affected and an updated package has been delivered, while the fix for the mysql8.0 package is deferred: the updated MySQL release only reached Fedora Rawhide, so systems running the vulnerable mysql8.0 package on stable Fedora releases remain exposed to denial of service by a highly privileged authenticated user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updated mysql packages have been delivered for the affected Red Hat Enterprise Linux releases and for Fedora's mysql8.4 package; users should apply the available updates through their configured update channels.