CVE-2025-30721 Denial of service in MySQL Server
A high-privileged attacker can cause a complete denial of service in MySQL Server via the UDF component, requiring local access and user interaction.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-30721?
CVE-2025-30721 is a medium-severity denial of service vulnerability in Oracle Mysql Server, published on 15 Apr 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H).
Which versions are affected by CVE-2025-30721?
It affects 1 product.
Products include Oracle Mysql Server.
How do I fix CVE-2025-30721?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30721 being exploited?
There is no known exploitation of CVE-2025-30721 in the wild and no public exploit code.
Other vulnerabilities in Oracle Mysql Server
Sources
Also known as AZL-62163, AZL-62182, GHSA-v29c-h5f4-7c2v, MINI-7wg7-fp3v-qx4v, MINI-g6cf-85fc-qhgc, MINI-v99m-fpx9-q462 and 1 more.