CVE-2026-35549

An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the cachingsha2password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256cryptr uses alloca.

Database specific

{
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35549.json",
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "11.4.10"
                },
                {
                    "introduced": "11.5.0"
                },
                {
                    "fixed": "11.8.6"
                },
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.2.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "11.4.10"
                },
                {
                    "introduced": "11.5.x"
                },
                {
                    "fixed": "11.8.x"
                },
                {
                    "fixed": "11.8.6"
                },
                {
                    "introduced": "12.x"
                },
                {
                    "fixed": "12.2.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type

GIT

Repo

https://github.com/mariadb/server

Events

Introduced

Fixed

054a893f1645b77e52a329a7fc8cf614eebd1fad

Fixed

d26a6f44c1f2119377e79a9540886c6d8c01472f

Introduced

8f0c9340537b84fcd7012d4a31e6f858e7eb919c

Fixed

9bfea48ce1214cc4470f6f6f8a4e30352cef84e7

Database specific

{
    "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.4.10"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.2.2"
        },
        {
            "introduced": "11.5.0"
        },
        {
            "fixed": "11.8.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

mariadb-10.*

mariadb-10.1.0

mariadb-10.1.2

mariadb-10.1.3

mariadb-10.1.4

mariadb-10.1.5

mariadb-10.1.6

mariadb-10.1.7

mariadb-10.1.8

mariadb-10.11.1

mariadb-10.2.0

mariadb-10.2.1

mariadb-10.2.2

mariadb-10.3.0

mariadb-10.3.1

mariadb-10.3.2

mariadb-10.3.4

mariadb-10.3.5

mariadb-10.3.6

mariadb-10.4.3

mariadb-10.4.4

mariadb-10.5.0

mariadb-10.5.2

mariadb-10.6.0

mariadb-10.6.1

mariadb-11.*

mariadb-11.0.1

mariadb-11.4.1

mariadb-11.4.2

mariadb-11.4.3

mariadb-11.4.4

mariadb-11.4.5

mariadb-11.4.6

mariadb-11.4.7

mariadb-11.4.8

mariadb-11.4.9

mariadb-11.5.1

mariadb-11.6.1

mariadb-11.7.1

mariadb-11.8.1

mariadb-11.8.2

mariadb-11.8.3

mariadb-11.8.4

mariadb-12.*

mariadb-12.1.1

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "deprecated": false,
        "target": {
            "file": "sql/sp_instr.cc"
        },
        "id": "CVE-2026-35549-22eb6579",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "331495033010792057398295084692551616862",
                "178889473583969224685848879336469251622",
                "72995215509533274417683389386874442936",
                "34733286214113447932010597917174327234",
                "220595837734737098186096626766433509208",
                "338750869998908232338240892716586972189",
                "200331074068810549623743321810491183265",
                "318528549273668054390962137954896768015",
                "26834430279848683763735550481300098934",
                "68590751291616411132278116452337632760",
                "155245705888256277018230600879388905005",
                "281201383801172153236642507346466029898",
                "11578098737963444869029556637210276545",
                "88679534638751502059684342659870334045",
                "174412566811641505963715332693034819441",
                "212479306865523010564552785282223352918",
                "264094808494796852436130642367514195992"
            ]
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "deprecated": false,
        "target": {
            "file": "sql/sp_instr.h"
        },
        "id": "CVE-2026-35549-f170ab29",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333736738574052575197108677744715005253",
                "262810137784205432405179339402165348111",
                "118178308854161151067014370856362614751",
                "10257631431620263937293216233444103471"
            ]
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "deprecated": false,
        "target": {
            "file": "sql/sp_instr.cc",
            "function": "sp_lex_instr::parse_expr"
        },
        "id": "CVE-2026-35549-fe069a50",
        "signature_type": "Function",
        "digest": {
            "length": 2658.0,
            "function_hash": "47421469537526624674199985998928255848"
        }
    }
]

vanir_signatures_modified

"2026-07-27T08:14:24Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35549.json"