CVE-2025-30704: 
MySQL vulnerability analysis and mitigation

A vulnerability (CVE-2025-30704) was discovered in Oracle MySQL Server's Components Services module. The affected versions include MySQL Server 8.0.0-8.0.41, 8.4.0-8.4.4, and 9.0.0-9.2.0. This vulnerability was disclosed on April 15, 2025, as part of Oracle's Critical Patch Update (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 4.4, indicating a moderate severity level. The CVSS vector is (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H), which indicates that the vulnerability requires network access, is difficult to exploit, and requires high privileges. The vulnerability has been classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DOS) of MySQL Server. The vulnerability only affects availability, with no direct impact on confidentiality or integrity (Oracle CPU, NVD).

The vulnerability is characterized as difficult to exploit and requires a high-privileged attacker with network access via multiple protocols to compromise MySQL Server. The high complexity and privilege requirements serve as natural barriers to exploitation (Oracle CPU).

Oracle has released patches for the affected versions through its Critical Patch Update (CPU) of April 2025. Users are strongly advised to apply these security patches as soon as possible to mitigate the risk (Oracle CPU).