CVE-2026-35549
Fixed in a distro release EPSS <1%CVSS 6.5
An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.
Products: MariaDB
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | mariadb-10.11 | 0 |
| Chainguard | mariadb-10.6 | 0 |
| Chainguard | mariadb-11.8 | 11.8.9-r1 |
| Chainguard | mariadb-12.1 | no fix |
| Debian 13 | mariadb | 1:11.8.6-0+deb13u1 |
| Debian 14 | mariadb | 1:11.8.6-1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | mariadb | 11.8.8-150700.3.15.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | mariadb | 11.8.8-150700.3.15.1 |
| SUSE Linux Enterprise Server 16.0 | mariadb | 11.8.8-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | mariadb | 11.8.8-160000.1.1 |
| Ubuntu 16.04 LTS | mariadb-10.0 | no fix |
| Ubuntu 18.04 LTS | mariadb-10.1 | no fix |
| Ubuntu 20.04 LTS | mariadb-10.3 | no fix |
| Ubuntu 22.04 LTS | mariadb-10.6 | no fix |
| Ubuntu 24.04 LTS | mariadb | no fix |
| Ubuntu 25.10 | mariadb | no fix |
| Wolfi | mariadb-10.11 | 0 |
| Wolfi | mariadb-10.6 | 0 |
| Wolfi | mariadb-11.8 | 11.8.9-r1 |
| Wolfi | mariadb-12.1 | no fix |
| openSUSE Leap 16.0 | mariadb | 11.8.8-160000.1.1 |
| openSUSE Tumbleweed | mariadb | 11.8.7-1.1 |