🎯 New Report #3871740: r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de )
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 808
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-18
⏰ Disclosed: 2026-10-12 09:06:59
📝 Summary: A server-controlled PBKDF2 iteration count vulnerability was discovered in the Parsec authentication plugin. The iteration value was read directly from the server response and only validated against a minimum threshold, allowing a malicious server to force excessive cryptographic computations. An attacker could specify a high iteration count that resulted in approximately 1.07 billion PBKDF2-HMAC-SHA512 rounds, causing a client CPU core to be pinned for extended periods during connection attempts. The vulnerability was introduced by a prior commit that loosened the iteration count validation. This vulnerability could be exploited repeatedly without valid credentials and was exposed by default plaintext connections.
📂 Report JSON File: 3871740
@hackeronereports