CVE-2026-35549

mediumCVSS 6.5covered by 1 sourcefirst seen 2026-08-06

CSIRTS triage

vendor: MariaDB product: MariaDB Server Denial of serviceaffected: before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2

What: A large packet can crash the server if the caching_sha2_password authentication plugin is installed and user accounts are configured to use it.
Who is affected: MariaDB Server deployments with caching_sha2_password authentication plugin enabled and affected user accounts.
Urgency: Medium severity (CVSS 6.5); denial of service via authenticated crash, not currently exploited.
Action: Upgrade to MariaDB Server 11.4.10, 11.8.6, or 12.2.2 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-35549

Get an email if CVE-2026-35549 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Low exploitation risk0.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-35549 status](https://www.csirts.com/badge/CVE-2026-35549)](https://www.csirts.com/cve/CVE-2026-35549)