CVE-2024-21236: 
MySQL vulnerability analysis and mitigation

A vulnerability has been identified in Oracle MySQL Server's InnoDB component, tracked as CVE-2024-21236. The affected versions include MySQL Server 8.0.39 and prior, 8.4.2 and prior, and 9.0.1 and prior. This security flaw has been assigned a CVSS 3.1 Base Score of 4.9 (Medium severity) (Oracle CPU).

The vulnerability is characterized by its network-based attack vector with low attack complexity, requiring high privileges for exploitation. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, indicating that while the attack complexity is low, it requires high-level privileges to execute. No user interaction is needed for exploitation, and the scope remains unchanged (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DoS) of MySQL Server. The impact is primarily focused on availability, with no direct effects on confidentiality or integrity (Oracle CPU).

The vulnerability is considered easily exploitable by attackers with high privileges who have network access via multiple protocols. The requirement for high privileges somewhat mitigates the risk, despite the low attack complexity (NVD).

Oracle has released patches to address this vulnerability in their October 2024 Critical Patch Update. Users are strongly advised to update their MySQL Server installations to versions newer than 8.0.39, 8.4.2, or 9.0.1 depending on their deployment branch (Oracle CPU).