CVE-2026-35549: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-35549 is a denial-of-service vulnerability in MariaDB Server's caching_sha2_password authentication plugin. When the plugin is installed and user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca, leading to memory allocation with an excessive size value. Affected versions include MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. It was published on April 3, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value): the sha256_crypt_r function within the caching_sha2_password plugin uses alloca to allocate stack memory based on attacker-controlled input size, without enforcing an upper bound. An authenticated attacker with low privileges can send an oversized network packet during the authentication handshake, triggering a stack overflow or crash in the server process. Exploitation requires that the caching_sha2_password plugin be installed and at least one user account be configured to use it; without this precondition, the vulnerable code path is not reachable. The issue is tracked upstream as MDEV-38365 (GitHub Advisory, MariaDB JIRA).

Successful exploitation causes the MariaDB Server process to crash, resulting in a complete denial of service for all database clients. The impact is limited to availability — there is no confidentiality or integrity compromise, and no data exfiltration or modification is possible through this vulnerability. All users and applications relying on the affected MariaDB instance will lose database access until the service is restarted, potentially disrupting dependent applications and services (GitHub Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.047–0.058%, placing it in the 18th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authenticated network access, which somewhat limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify MariaDB Server instances running vulnerable versions (before 11.4.10, 11.5.x–11.8.x before 11.8.6, or 12.x before 12.2.2) using network scanning tools such as Nmap with MariaDB service detection.
2. Verify plugin presence: Authenticate with any low-privilege account and query SELECT * FROM information_schema.PLUGINS WHERE PLUGIN_NAME = 'caching_sha2_password'; to confirm the plugin is installed and active.
3. Identify target accounts: Determine if any user accounts are configured to use caching_sha2_password by querying SELECT user, plugin FROM mysql.user WHERE plugin = 'caching_sha2_password';.
4. Craft oversized authentication packet: Construct a malformed authentication packet with an excessively large payload targeting the caching_sha2_password handshake phase, exploiting the unbounded alloca call in sha256_crypt_r.
5. Send packet to server: Transmit the crafted packet to the MariaDB server's listening port (default 3306), triggering the stack memory allocation failure and crashing the server process, resulting in denial of service (GitHub Advisory, MariaDB JIRA).

• Network: Unusual or malformed authentication packets on TCP port 3306 with abnormally large payload sizes; repeated connection attempts from a single source IP targeting the MariaDB authentication phase.
• Logs: MariaDB error log (/var/log/mysql/error.log or equivalent) showing unexpected server crashes or segmentation faults correlated with authentication events; entries referencing caching_sha2_password plugin errors.
• Process: Unexpected termination of the mysqld process; crash dump files (core dumps) generated in the MariaDB data directory following authentication-phase activity.
• System: Repeated MariaDB service restarts in system logs (journalctl -u mariadb or /var/log/syslog) without administrative action, indicating crash-restart cycles.

Upgrade MariaDB Server to a patched version: 11.4.10 or later (for the 11.4.x branch), 11.8.6 or later (for the 11.5.x–11.8.x branch), or 12.2.2 or later (for the 12.x branch) (GitHub Advisory). If immediate patching is not feasible, consider disabling the caching_sha2_password authentication plugin or migrating affected user accounts to an alternative authentication plugin. Additionally, restrict network access to the MariaDB port (default 3306) using firewall rules to limit exposure to trusted hosts only, and enforce the principle of least privilege for database accounts. SUSE has released a security update (SUSE-SU-2026:2330-1) for affected SUSE Linux Enterprise packages (SUSE Advisory).

SUSE issued a security advisory (SUSE-SU-2026:2330-1) addressing this and other MariaDB vulnerabilities in their enterprise Linux packages (SUSE Advisory). Spain's INCIBE-CERT also published an early warning alert for the vulnerability (INCIBE-CERT). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.