Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-53053: Oracle MySQL Database Can Be Crashed or Hacked

CVE-2025-53053 · published 1 year ago

Summary

Multiple versions of Oracle MySQL (8.0.0-8.0.43, 8.4.0-8.4.6, and 9.0.0-9.4.0) can be exploited by an attacker with high privileges to crash or repeatedly shut down the database, or allow unauthorized access to sensitive data. This is a significant risk because a crashed database can cause downtime and data loss. Oracle has likely released a patch to fix this issue, and it's essential to apply the update as soon as possible to prevent potential attacks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	mysql_server	>= 8.0.0, <= 8.0.42 >= 8.4.0, <= 8.4.6 >= 9.0.0, <= 9.4.0 `cpe:2.3:a:oracle:mysql_server::::::::`

Original advisory text

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerab...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53053... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-53053 Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2025.html Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published21 Oct 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-53053 · NVD

CVE-2025-53053 · OSV

Track software like this

Free during beta