🎯 New Report #3781201: Pre-authentication `size t` integer underflow → out-of-bounds read / server crash in MariaDB `caching sha2 password` (auth mysql sha2) via an RSA-OAEP
🔺Severity: Medium
👽 Reporter: vnth4nhnt
⭐️ Reputation: 136
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-10-07 19:54:09
📝 Summary: A pre-authentication integer underflow vulnerability was discovered in the caching sha2 password authentication plugin. When a client sent an RSA-OAEP encrypted empty message over plaintext TCP, the decrypted length was not validated before being used in a subtraction operation. This caused a size t integer underflow that resulted in an out-of-bounds read in the SHA-256 hashing routine. The vulnerability allowed an unauthenticated attacker to crash the database server without requiring valid credentials.
📂 Report JSON File: 3781201
@hackeronereports