CVE-2026-35549
- Source
- https://cve.org/CVERecord?id=CVE-2026-35549
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35549.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-35549
- Aliases
- Downstream
BELL (1)
CGA (7)
DEBIAN (1)
MINI (9)
openSUSE (2)
UBUNTU (1)
- Related
- Published
- 2026-04-03T05:00:18Z
- Modified
- 2026-11-08T07:11:23Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.
- Database specific
{ "cna_assigner": "mitre", "cwe_ids": [ "CWE-789" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35549.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "fixed": "11.4.10" }, { "introduced": "11.5.0" }, { "fixed": "11.8.6" }, { "introduced": "12.0.0" }, { "fixed": "12.2.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
Affected packages
Git / github.com/mariadb/server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mariadb/server
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "11.8.4" }, { "fixed": "11.8.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.1.1" }, { "fixed": "12.2.2" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mariadb:mariadb:11.4.9:*:*:*:*:*:*:*", "range": [ { "introduced": "11.4.9" }, { "last_affected": "11.4.9" } ], "source": "CPE_STRING" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35549.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"331495033010792057398295084692551616862",
"178889473583969224685848879336469251622",
"72995215509533274417683389386874442936",
"34733286214113447932010597917174327234",
"220595837734737098186096626766433509208",
"338750869998908232338240892716586972189",
"200331074068810549623743321810491183265",
"318528549273668054390962137954896768015",
"26834430279848683763735550481300098934",
"68590751291616411132278116452337632760",
"155245705888256277018230600879388905005",
"281201383801172153236642507346466029898",
"11578098737963444869029556637210276545",
"88679534638751502059684342659870334045",
"174412566811641505963715332693034819441",
"212479306865523010564552785282223352918",
"264094808494796852436130642367514195992"
],
"threshold": 0.9
},
"id": "CVE-2026-35549-22eb6579",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
"target": {
"file": "sql/sp_instr.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"333736738574052575197108677744715005253",
"262810137784205432405179339402165348111",
"118178308854161151067014370856362614751",
"10257631431620263937293216233444103471"
],
"threshold": 0.9
},
"id": "CVE-2026-35549-f170ab29",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
"target": {
"file": "sql/sp_instr.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47421469537526624674199985998928255848",
"length": 2658
},
"id": "CVE-2026-35549-fe069a50",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/d26a6f44c1f2119377e79a9540886c6d8c01472f",
"target": {
"file": "sql/sp_instr.cc",
"function": "sp_lex_instr::parse_expr"
}
}
]
vanir_signatures_modified
"2026-11-08T07:11:23Z"