# CVE-2026-35549: MariaDB Server denial of service in caching_sha2_password plugin

Source: https://junglewise.ai/threats/cve-2026-35549-mariadb-server-denial-of-service-in-caching-sha2-password-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-35549 · Severity: medium · CVSS 6.5 · Published 2026-04-03

MariaDB Server is a widely used database system for storing and managing corporate data. A vulnerability in its authentication system allows a user with valid login credentials to crash the database server by sending a specially crafted large data packet. This can lead to a complete service outage, disrupting business operations and application availability until the server is restarted.

Technologies: [MariaDB Foundation MariaDB Server](https://junglewise.ai/threats/technologies/mariadb-server). Vendors: [MariaDB Foundation](https://junglewise.ai/threats/vendors/mariadb-foundation).

## Quick answers

**Is CVE-2026-35549 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35549 being exploited in the wild.

**How severe is CVE-2026-35549?** Medium severity, with a CVSS score of 6.5, published 3 April 2026.

**Which products and versions are affected?** MariaDB Foundation MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2.

**Is there a fix for CVE-2026-35549?** A patch was published on 2026-01-24: Issue resolved in source code Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35549 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-35549?** Check whether you run MariaDB Foundation MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in MariaDB Server's caching_sha2_password authentication plugin. The root cause is the use of the alloca() function within the sha256_crypt_r() routine, which attempts to allocate memory on the stack based on the size of an incoming network packet. An authenticated attacker can send a large packet that exceeds the stack limits, causing a stack overflow and subsequent server crash. The issue is tracked as CWE-789 (Memory Allocation with Excessive Size Value) and has been resolved in versions 11.4.10, 11.8.6, and 12.2.2.

## Affected products

- MariaDB MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2

## Timeline

- 2025-12-17: other: Issue created in MariaDB Jira
- 2026-01-24: patched: Issue resolved in source code
- 2026-04-03: disclosed: CVE published

## References

- [https://jira.mariadb.org/browse/MDEV-38365](https://jira.mariadb.org/browse/MDEV-38365)

## Related threats

- [MariaDB Server incorrect authorization for FILE privilege in subqueries](https://junglewise.ai/threats/cve-2026-44173-mariadb-server-incorrect-authorization-for-file-privilege-in)
- [MariaDB OS command injection in CONNECT engine on Windows](https://junglewise.ai/threats/cve-2026-44170-mariadb-os-command-injection-in-connect-engine-on-windows)
- [MariaDB Server authorization bypass in stored routine definitions](https://junglewise.ai/threats/cve-2026-44169-mariadb-server-authorization-bypass-in-stored-routine-definitions)
- [MariaDB and Amazon RDS audit log bypass via SQL comment prefixing](https://junglewise.ai/threats/cve-2026-3494-mariadb-and-amazon-rds-audit-log-bypass-via-sql-comment-prefixing)