CVE-2026-35549

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35549
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35549.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35549
Aliases
Downstream
Related
Published
2026-04-03T05:00:18.121Z
Modified
2026-07-08T08:05:07.349417505Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the cachingsha2password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256cryptr uses alloca.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "11.4.10"
                },
                {
                    "introduced": "11.5.0"
                },
                {
                    "fixed": "11.8.6"
                },
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.2.2"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "11.4.10"
                },
                {
                    "introduced": "11.5.x"
                },
                {
                    "fixed": "11.8.x"
                },
                {
                    "fixed": "11.8.6"
                },
                {
                    "introduced": "12.x"
                },
                {
                    "fixed": "12.2.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35549.json",
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-789"
    ]
}
References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type
GIT
Repo
https://github.com/mariadb/server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
054a893f1645b77e52a329a7fc8cf614eebd1fad
Fixed
d26a6f44c1f2119377e79a9540886c6d8c01472f
Introduced
8f0c9340537b84fcd7012d4a31e6f858e7eb919c
Fixed
9bfea48ce1214cc4470f6f6f8a4e30352cef84e7
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.4.10"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.2.2"
        },
        {
            "introduced": "11.5.0"
        },
        {
            "fixed": "11.8.6"
        }
    ]
}

Affected versions

mariadb-10.*
mariadb-10.1.0
mariadb-10.1.2
mariadb-10.1.3
mariadb-10.1.4
mariadb-10.1.5
mariadb-10.1.6
mariadb-10.1.7
mariadb-10.1.8
mariadb-10.11.1
mariadb-10.2.0
mariadb-10.2.1
mariadb-10.2.2
mariadb-10.3.0
mariadb-10.3.1
mariadb-10.3.2
mariadb-10.3.4
mariadb-10.3.5
mariadb-10.3.6
mariadb-10.4.3
mariadb-10.4.4
mariadb-10.5.0
mariadb-10.5.2
mariadb-10.6.0
mariadb-10.6.1
mariadb-11.*
mariadb-11.0.1
mariadb-11.4.1
mariadb-11.4.2
mariadb-11.4.3
mariadb-11.4.4
mariadb-11.4.5
mariadb-11.4.6
mariadb-11.4.7
mariadb-11.4.8
mariadb-11.4.9
mariadb-11.5.1
mariadb-11.6.1
mariadb-11.7.1
mariadb-11.8.1
mariadb-11.8.2
mariadb-11.8.3
mariadb-11.8.4
mariadb-12.*
mariadb-12.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35549.json"