medium CVSS 6.5

CVE-2026-35549·MariaDB vulnerability

An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.

Severity
medium
Software
MariaDB
Fixed in
12.2.2
Published
2026-04-03

Affected versions

From: 12.0.0

Until: 12.2.2

Fixed in: 12.2.2

How to fix this CVE

Update MariaDB Server to version 12.2.2 or later to resolve a denial-of-service vulnerability in the caching_sha2_password authentication plugin. This vulnerability affects instances where the plugin is enabled and user accounts are configured to use it. Apply the security patch immediately to prevent potential server crashes from specially crafted authentication packets.

sudo dnf update mariadb-server

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check installed MariaDB version by running 'mariadb --version' or 'mysql -u root -p -e "SELECT VERSION();"'
  2. Step 2: Verify if caching_sha2_password plugin is installed by querying 'SELECT PLUGIN_NAME FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME = "caching_sha2_password";'
  3. Step 3: List user accounts using caching_sha2_password with 'SELECT User, Host, plugin FROM mysql.user WHERE plugin = "caching_sha2_password";'
  4. Step 4: After updating, confirm the new version with 'mariadb --version' and verify the plugin remains properly configured

FAQ

What is CVE-2026-35549?

This CVE describes a denial-of-service vulnerability in MariaDB's caching_sha2_password authentication plugin where overly large packets trigger unsafe stack allocation, causing the server to crash during authentication attempts.

Is CVE-2026-35549 being actively exploited?

No, this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are available.

What versions of MariaDB are affected by CVE-2026-35549?

MariaDB 12.0.0 through 12.2.1 are affected. Earlier affected versions include 11.4.x before 11.4.10 and 11.5.x through 11.8.x before 11.8.6.

How do I check if my server is vulnerable to CVE-2026-35549?

Run 'mariadb --version' to check your version. If it is 12.0.0-12.2.1 and the caching_sha2_password plugin is active (verify with INFORMATION_SCHEMA.PLUGINS), your server is vulnerable.

Does Defensia detect CVE-2026-35549?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-35549 will appear in your dashboard with remediation steps.

Related MariaDB CVEs

CVE-2026-49261CVSS 10MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
CVE-2026-44170CVSS 9.8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-22730CVSS 8.8A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
CVE-2026-32710CVSS 8.5MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
CVE-2026-48165CVSS 8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-35549. Free for 1 server.

Get started free