CVE-2026-35549

An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.

Database specific

{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35549.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "11.4.10"
                },
                {
                    "introduced": "11.5.0"
                },
                {
                    "fixed": "11.8.6"
                },
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.2.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "11.4.10"
                },
                {
                    "introduced": "11.5.x"
                },
                {
                    "fixed": "11.8.x"
                },
                {
                    "fixed": "11.8.6"
                },
                {
                    "introduced": "12.x"
                },
                {
                    "fixed": "12.2.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type

GIT

Repo

https://github.com/mariadb/server

Events

Introduced

Fixed

054a893f1645b77e52a329a7fc8cf614eebd1fad

Fixed

d26a6f44c1f2119377e79a9540886c6d8c01472f

Introduced

8f0c9340537b84fcd7012d4a31e6f858e7eb919c

Fixed

9bfea48ce1214cc4470f6f6f8a4e30352cef84e7

Database specific

Show details

{
    "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.4.10"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.2.2"
        },
        {
            "introduced": "11.5.0"
        },
        {
            "fixed": "11.8.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

mariadb-10.*

mariadb-10.1.0

mariadb-10.1.2

mariadb-10.1.3

mariadb-10.1.4

mariadb-10.1.5

mariadb-10.1.6

mariadb-10.1.7

mariadb-10.1.8

mariadb-10.11.1

mariadb-10.2.0

mariadb-10.2.1

mariadb-10.2.2

mariadb-10.3.0

mariadb-10.3.1

mariadb-10.3.2

mariadb-10.3.4

mariadb-10.3.5

mariadb-10.3.6

mariadb-10.4.3

mariadb-10.4.4

mariadb-10.5.0

mariadb-10.5.2

mariadb-10.6.0

mariadb-10.6.1

mariadb-11.*

mariadb-11.0.1

mariadb-11.4.1

mariadb-11.4.2

mariadb-11.4.3

mariadb-11.4.4

mariadb-11.4.5

mariadb-11.4.6

mariadb-11.4.7

mariadb-11.4.8

mariadb-11.4.9

mariadb-11.5.1

mariadb-11.6.1

mariadb-11.7.1

mariadb-11.8.1

mariadb-11.8.2

mariadb-11.8.3

mariadb-11.8.4

mariadb-12.*

mariadb-12.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35549.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "331495033010792057398295084692551616862",
                "178889473583969224685848879336469251622",
                "72995215509533274417683389386874442936",
                "34733286214113447932010597917174327234",
                "220595837734737098186096626766433509208",
                "338750869998908232338240892716586972189",
                "200331074068810549623743321810491183265",
                "318528549273668054390962137954896768015",
                "26834430279848683763735550481300098934",
                "68590751291616411132278116452337632760",
                "155245705888256277018230600879388905005",
                "281201383801172153236642507346466029898",
                "11578098737963444869029556637210276545",
                "88679534638751502059684342659870334045",
                "174412566811641505963715332693034819441",
                "212479306865523010564552785282223352918",
                "264094808494796852436130642367514195992"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-35549-22eb6579",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "target": {
            "file": "sql/sp_instr.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "333736738574052575197108677744715005253",
                "262810137784205432405179339402165348111",
                "118178308854161151067014370856362614751",
                "10257631431620263937293216233444103471"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-35549-f170ab29",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "target": {
            "file": "sql/sp_instr.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47421469537526624674199985998928255848",
            "length": 2658
        },
        "id": "CVE-2026-35549-fe069a50",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
        "target": {
            "file": "sql/sp_instr.cc",
            "function": "sp_lex_instr::parse_expr"
        }
    }
]

vanir_signatures_modified

"2026-08-12T16:23:52Z"