Quick answers
- Is CVE-2026-35549 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35549 being exploited in the wild.
- How severe is CVE-2026-35549?
- Medium severity, with a CVSS score of 6.5, published 3 April 2026.
- Which products and versions are affected?
- MariaDB Foundation MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2.
- Is there a fix for CVE-2026-35549?
- A patch was published on 2026-01-24: Issue resolved in source code Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-35549 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-35549?
- Check whether you run MariaDB Foundation MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in MariaDB Server's caching_sha2_password authentication plugin. The root cause is the use of the alloca() function within the sha256_crypt_r() routine, which attempts to allocate memory on the stack based on the size of an incoming network packet. An authenticated attacker can send a large packet that exceeds the stack limits, causing a stack overflow and subsequent server crash. The issue is tracked as CWE-789 (Memory Allocation with Excessive Size Value) and has been resolved in versions 11.4.10, 11.8.6, and 12.2.2.
Affected products
- MariaDB MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2
Timeline
- 2025-12-17: other: Issue created in MariaDB Jira
- 2026-01-24: patched: Issue resolved in source code
- 2026-04-03: disclosed: CVE published