CVE-2025-50097: 
MySQL vulnerability analysis and mitigation

CVE-2025-50097 is a Denial of Service vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Security: Encryption component. It affects MySQL Server versions 8.0.0–8.0.42, 8.4.0–8.4.5, and 9.0.0–9.3.0. The vulnerability was disclosed on July 15, 2025, as part of Oracle's Critical Patch Update (CPU) for July 2025. It carries a CVSS v3.1 base score of 4.9 (Medium) (Oracle CPU July 2025).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the server fails to properly limit resource usage when processing certain encryption-related operations. An attacker with high privileges and network access via multiple protocols can trigger this flaw to cause the MySQL Server to hang or crash repeatedly. No user interaction is required, and attack complexity is low, making it straightforward to exploit given the required administrative credentials. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU July 2025).

Successful exploitation results in a complete Denial of Service (DoS) of the MySQL Server — the server may hang or crash in a frequently repeatable manner, rendering the database unavailable. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. Downstream applications and services dependent on the affected MySQL instance would also be disrupted during an attack (Oracle CPU July 2025).

Oracle has released patches addressing this vulnerability as part of the July 2025 Critical Patch Update. Administrators should upgrade MySQL Server to version 8.0.43 or later (for the 8.0.x branch), 8.4.6 or later (for the 8.4.x branch), or a patched 9.x release beyond 9.3.0. As a temporary workaround, restrict network access to the MySQL Server and limit administrative privileges to trusted accounts only. Oracle strongly recommends applying the CPU patches without delay (Oracle CPU July 2025).