CVE-2021-2471: Incorrect Authorization in MySQL Connector Java
Summary
CVE-2021-2471: Incorrect Authorization in MySQL Connector Java. Affects mysql:mysql-connector-java versions >= 8.0.0, < 8.0.27. Fixed in 8.0.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MySQL Connector Java is a library that enables Java applications to connect to and interact with MySQL databases. It provides a set of classes and methods for establishing connections, executing queries, and managing data. The vulnerability identified as CVE-2021-2471 affects versions 8.0.26 and prior of the MySQL Connector Java. This vulnerability allows a high privileged attacker with network access to compromise MySQL Connectors. Exploiting this vulnerability can lead to unauthorized access to critical data, complete access to all accessible data, and the ability to cause a denial-of-service (DoS) attack by crashing the MySQL Connectors. The Common Vulnerability Scoring System (CVSS) 3.1 Base Score for this vulnerability is 5.9, indicating moderate severity in terms of confidentiality and availability impacts.
Vulnerability Detail
The vulnerability in MySQL Connector Java arises from an incorrect authorization issue. It can be exploited by a high privileged attacker with network access via multiple protocols. The vulnerability allows unauthorized access to critical data or complete access to all MySQL Connectors accessible data. Additionally, the attacker can cause a hang or frequently repeatable crash, resulting in a denial-of-service (DoS) attack. The vulnerability has a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H.
How To Fix
Latest published version: 8.0.33 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.27
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to upgrade to the latest version of the MySQL Connector Java.
Conclusion
The vulnerability identified as CVE-2021-2471 in MySQL Connector Java can lead to unauthorized access to critical data, complete access to all accessible data, and the ability to cause a denial-of-service (DoS) attack. It is crucial to upgrade to version 8.0.27 or later of the MySQL Connector Java to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mysql:mysql-connector-java →
FAQ
MySQL Connector Java is a library that enables Java applications to connect to and interact with MySQL databases. It provides a set of classes and methods for establishing connections, executing queries, and managing data.
Versions 8.0.26 and prior of the MySQL Connector Java are affected by this vulnerability.
Exploiting this vulnerability can result in unauthorized access to critical data, complete access to all MySQL Connectors accessible data, and the ability to cause a hang or frequently repeatable crash (DoS) of MySQL Connectors.
The CVSS 3.1 Base Score for this vulnerability is 5.9, indicating moderate severity in terms of confidentiality and availability impacts.
To fix this vulnerability, it is recommended to upgrade to version 8.0.27 or later of the MySQL Connector Java.
Related vulnerabilities
Recent vulnerabilities recorded for mysql:mysql-connector-java.
