CVE-2026-35549: Medium severity MariaDB MariaDB Server vulnerability
An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the cachingsha2password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256cryptr uses alloca.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.4.10 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 11.8.6 - Upgrade
Upgrade
MariaDB Serverto a version that resolves this vulnerability.Fixed in 12.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35549?
CVE-2026-35549 has a high severity rating due to its potential to crash the MariaDB server.
How do I fix CVE-2026-35549?
To fix CVE-2026-35549, update your MariaDB Server to version 11.4.10, 11.8.6, or 12.2.2 or later.
Which versions of MariaDB are affected by CVE-2026-35549?
CVE-2026-35549 affects MariaDB Server versions before 11.4.10, 11.8.6, and 12.2.2.
What is the impact of CVE-2026-35549 on user accounts?
If the caching_sha2_password authentication plugin is used, a large packet can cause the server to crash.
Can CVE-2026-35549 be exploited remotely?
Yes, CVE-2026-35549 can potentially be exploited remotely if the affected versions are used with misconfigured user accounts.