CVE-2026-35549
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Apr 3, 2026
CISA due date
—
The record
An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | mariadb | 0 | 11.8.8-160000.1.1 |
| openSUSE:Tumbleweed | mariadb | 0 | 11.8.7-1.1 |
Related vulnerabilities
- CVE-2026-48165 MariaDB server is a community developed fork of MySQL server. Also affects mariadb
- CVE-2026-48163 MariaDB server is a community developed fork of MySQL server. Also affects mariadb
- CVE-2026-44172 MariaDB server is a community developed fork of MySQL server. Also affects mariadb
- CVE-2026-44173 MariaDB server is a community developed fork of MySQL server. Also affects mariadb
- CVE-2026-44168 MariaDB server is a community developed fork of MySQL server. Also affects mariadb
- CVE-2026-44169 MariaDB server is a community developed fork of MySQL server. Also affects mariadb
- CVE-2026-44170 MariaDB server is a community developed fork of MySQL server. Also affects mariadb
- CVE-2026-44171 MariaDB server is a community developed fork of MySQL server. Also affects mariadb