Skip to content
fr Sign in
6.5 Medium

CVE-2026-35549 An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2

Description

An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.

Affected products and versions

Product Affected versions Fixed in
MariaDB 12.0 12.0.0 → < 12.2.2 12.2.2
MariaDB 11.5 11.5.0 → < 11.8.6 11.8.6
MariaDB 11.4 earliest → < 11.4.10 11.4.10

References

Timeline

  1. Published
  2. Last modified

Other CVEs of MariaDB

The 13 CVEs of MariaDB →
CVE-2025-13699 MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability 7.0 High CVE-2023-52969 MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, and 11.0 through 11.0.* can sometimes… 4.9 Medium CVE-2023-52968 MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0… 4.9 Medium CVE-2023-52970 MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through 10.11.*, 11.0 through 11.0.*, and 11.1 through… 4.9 Medium
Track this CVE