CVE-2026-35549

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35549", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-04-03T05:00:17.626Z", "datePublished": "2026-04-03T05:00:18.121Z", "dateUpdated": "2026-04-03T14:34:04.466Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MariaDB", "vendor": "MariaDB", "versions": [{"lessThan": "11.4.10", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "11.8.6", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThan": "12.2.2", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-03T05:00:18.121Z"}, "references": [{"url": "https://jira.mariadb.org/browse/MDEV-38365"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T14:33:50.651023Z", "id": "CVE-2026-35549", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T14:34:04.466Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35549", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T14:33:50.651023Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T14:33:57.055Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MariaDB", "product": "MariaDB", "versions": [{"status": "affected", "version": "0", "lessThan": "11.4.10", "versionType": "semver"}, {"status": "affected", "version": "11.5.0", "lessThan": "11.8.6", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://jira.mariadb.org/browse/MDEV-38365"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-03T05:00:18.121Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35549", "state": "PUBLISHED", "dateUpdated": "2026-04-03T14:34:04.466Z", "dateReserved": "2026-04-03T05:00:17.626Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-03T05:00:18.121Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MariaDB", "vendor": "MariaDB", "versions": [{"lessThan": "11.4.10", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "11.8.6", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThan": "12.2.2", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEE1EC91-7536-453A-9DF9-EA12EDBB672E", "versionEndExcluding": "11.8.6", "versionStartIncluding": "11.8.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "89945079-F567-4AF5-BE4A-A11B86A55595", "versionEndExcluding": "12.2.2", "versionStartIncluding": "12.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:11.4.9:*:*:*:*:*:*:*", "matchCriteriaId": "957A9BFF-2B87-441B-B1B9-F3BCA12398D0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en MariaDB Server antes de 11.4.10, 11.5.x hasta 11.8.x antes de 11.8.6, y 12.x antes de 12.2.2. Si el plugin de autenticaci\u00f3n caching_sha2_password est\u00e1 instalado, y algunas cuentas de usuario est\u00e1n configuradas para usarlo, un paquete grande puede bloquear el servidor porque sha256_crypt_r usa alloca."}], "id": "CVE-2026-35549", "lastModified": "2026-11-06T18:18:14.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35549", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T14:33:50.651023Z", "version": "2.0.3"}}]}, "published": "2026-04-03T05:16:23.160", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://jira.mariadb.org/browse/MDEV-38365"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "MariaDB Server: MariaDB Server: Denial of Service via large packet with caching_sha2_password authentication plugin", "id": "2454731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454731"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.", "A flaw was found in MariaDB Server. When the `caching_sha2_password` authentication plugin is installed and used by some user accounts, a low-privileged authenticated user can send a specially crafted large packet. This can cause the server to crash due to an issue with the `sha256_crypt_r` function's use of `alloca`, a function for allocating memory on the stack. This vulnerability leads to a Denial of Service (DoS), making the database server unavailable."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-35549", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb10.11", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb11.8", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.5/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb:11.8/mariadb", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T05:00:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-35549\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35549\nhttps://jira.mariadb.org/browse/MDEV-38365"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,11.4.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.5.0,11.8.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MariaDB", "source": "cna", "vendor": "MariaDB"}, "product": "mariadb", "vendor": "mariadb"}], "analysis": {"en": {"generated_at": "2026-04-07T02:14:13.085290+00:00", "value": {"mitigation_remediation": ["Upgrade MariaDB Server to version 11.4.10 or later, 11.5.x through 11.8.x up to 11.8.6, or 12.x 12.2.2 or later.", "If an upgrade is not immediately possible, disable the caching_sha2_password authentication plugin or reconfigure user accounts to use a different authentication plugin.", "Monitor database logs for unusually large authentication packets and apply additional network filtering if necessary.", "Apply any vendor\u2011issued hotfixes or security patches promptly."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "MariaDB Server versions prior to 11.4.10, all 11.5.x releases up to and including 11.8.5, and 12.x versions preceding 12.2.2 are affected when the caching_sha2_password authentication plugin is installed and user accounts are configured to use it.", "description_and_impact": "A defect in the caching_sha2_password authentication plugin causes the server to crash when it receives an excessively large packet during the authentication process. The bug arises because the sha256_crypt_r routine uses the alloca function, which can exhaust stack resources, leading to an abrupt termination of the MariaDB Server process. The result is a denial\u2011of\u2011service condition that disrupts database availability for all users.", "risk_and_exploitability": "The entry has a CVSS score of 6.5, indicating a moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The vulnerability is exploitable remotely by any client that can establish a connection to the server and supply a large packet during authentication with the caching_sha2_password plugin. The attack requires no privileged credentials and results only in service disruption; the attacker loses confidentiality and integrity is not affected. The likely attack vector is network\u2011based, so any exposed MariaDB instance could be vulnerable if the plugin is active."}}}}, "created": "2026-04-03T07:30:58.626504+00:00", "updated": "2026-04-07T07:55:11.391605+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$mariadb"]}