CVE-2026-35549
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In MariaDB Server before versions 11.4.10, 11.5.x-11.8.x before 11.8.6, and 12.x before 12.2.2, a vulnerability was found where a large packet can crash the server if the caching_sha2_password authentication plugin is installed and some user accounts are configured to use it. The issue is due to alloca usage in sha256_crypt_r.
Risk Assessment
An attacker can crash the MariaDB server, leading to database service disruption and potential availability loss.
Recommendation
Update MariaDB Server to version 11.4.10, 11.8.6, or 12.2.2 depending on the branch, or temporarily disable the caching_sha2_password plugin if feasible.
Other vulnerabilities in MariaDB Server
See all- CVE-2026-49261Critical
A vulnerability in MariaDB Server allows execution of arbitrary shell commands embedded in the joiner node name when `wsrep_notify_cmd` is enabled. Affected versions: 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1.
- CVE-2026-44171Medium
MariaDB server versions from 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 had an issue with not checking for /../ in the path when unpacking the archive. A specially crafted archive could have caused mbstream to create files outside of the target-dir path.
- CVE-2026-44169Medium
In MariaDB versions from 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user with EXECUTE access to a stored routine could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
Original NVD description (English source)
An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.