CVE-2025-21490: 
MySQL vulnerability analysis and mitigation

A vulnerability was discovered in the MySQL Server product, specifically in the InnoDB component. The vulnerability was disclosed on January 21, 2025, affecting MySQL Server versions 8.0.40 and prior, 8.4.3 and prior, 9.0.1 and prior, and 9.1.0 and prior (Oracle CPE).

The vulnerability has been assigned a CVSS v3.1 base score of 4.9, with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The attack vector is Network-based, with Low attack complexity, requiring High privileges, and No user interaction. The scope is Unchanged, with No impact on confidentiality and integrity, but High impact on availability (Red Hat CVE).

This vulnerability allows a high-privileged attacker to cause a denial of service condition in the MySQL Server, resulting in frequent crashes or hangs via multiple network protocols. The impact primarily affects system availability while maintaining no impact on confidentiality or integrity of the data (Red Hat CVE).

Updates have been released to address this vulnerability. MySQL has been updated to version 8.0.41 in various Ubuntu versions (20.04 LTS, 22.04 LTS, 24.04 LTS, and 24.10). Users are strongly advised to update their MySQL Server installations to the patched versions (Ubuntu Notice).