Executive brief
MariaDB Server is a widely used database system for storing and managing corporate data. A vulnerability in its authentication system allows a user with valid login credentials to crash the database server by sending a specially crafted large data packet. This can lead to a complete service outage, disrupting business operations and application availability until the server is restarted.
Technical details
A denial-of-service vulnerability exists in MariaDB Server's caching_sha2_password authentication plugin. The root cause is the use of the alloca() function within the sha256_crypt_r() routine, which attempts to allocate memory on the stack based on the size of an incoming network packet. An authenticated attacker can send a large packet that exceeds the stack limits, causing a stack overflow and subsequent server crash. The issue is tracked as CWE-789 (Memory Allocation with Excessive Size Value) and has been resolved in versions 11.4.10, 11.8.6, and 12.2.2.
Affected products
- MariaDB MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2
Timeline
- 2025-12-17: other: Issue created in MariaDB Jira
- 2026-01-24: patched: Issue resolved in source code
- 2026-04-03: disclosed: CVE published