{"id":"BIT-mysql-client-2026-35549","details":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.","aliases":["BIT-mariadb-2026-35549","BIT-mariadb-min-2026-35549","CVE-2026-35549"],"modified":"2026-09-08T08:47:44.287796308Z","published":"2026-06-05T05:51:29.789Z","database_specific":{"cpes":["cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*"],"severity":"Medium"},"references":[{"type":"REPORT","url":"https://jira.mariadb.org/browse/MDEV-38365"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549"}],"affected":[{"package":{"name":"mysql-client","ecosystem":"Bitnami","purl":"pkg:bitnami/mysql-client"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.4.10"},{"introduced":"11.5.0"},{"fixed":"11.8.6"},{"introduced":"12.0.0"},{"fixed":"12.2.2"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/mysql-client/BIT-mysql-client-2026-35549.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}],"schema_version":"1.9.0"}