MariaDB CVE-2026-35549

CVSS score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a network-reachable denial-of-service requiring low privilege authentication and no user interaction, causing availability impact only. The critical prerequisite is that caching_sha2_password must be installed and in-use; this is not the default authentication plugin in all MariaDB configurations, which may limit real-world exposure compared to the moderate CVSS score suggests. Attack complexity is low-a simple large packet triggers the crash-making the exploit straightforward for any authenticated user. Exploitation requires valid credentials (PR:L), eliminating completely unauthenticated attack scenarios. The vulnerability is actionable but contextual: organizations using caching_sha2_password face higher risk; those using alternative authentication methods are unaffected. This should be prioritized for patching in environments where caching_sha2_password is actively deployed, but may be lower priority in default deployments.

An attacker with valid database credentials connects to the MariaDB server and sends a malformed or oversized authentication packet to the caching_sha2_password plugin during the authentication handshake. The sha256_crypt_r function processes the packet size without bounds checking, calling alloca() to allocate a stack buffer proportional to the packet size. A packet exceeding available stack memory causes a stack overflow, immediately crashing the MariaDB server process and causing denial of service. No public proof-of-concept is currently identified, but the exploit is trivial for any authenticated user to trigger given low attack complexity.