MariaDB · disclosed reports
Memory Corruption
22 disclosed reports · $0 paid · 22 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open MariaDB on HackerOne- reports
- 22
- valid
- 22
- paid a bounty
- 0
Every one of the 22 is a mark on the map. Named now: 1 to 22, most upvoted first.
- Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client
- Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking
- Connector/C Out-of-bounds read in `unpack_fields()` from short metadata field
- Stack Buffer-Overflow in MariaDB Charset_collation_map_st::insert_or_replace()
- libmariadb ( mariadb-connector-c ): stack overflow via server-controlled field->length in prepared-statement codec
- Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server
- Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables
- Heap Memory Disclosure via Integer Underflow in Item_func_json_arrayagg::cut_max_length in MariaDB Server
- Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read
- Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEP
- Use-After-Free in BTREE Index Traversal via Stale key_version in heap_update() in MariaDB Server
- Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM)
- KILL authorization trusts the presented login name instead of the authenticated anonymous account
- Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the server
- Connector/ODBC: malicious server's long version string wraps size_t PrefixLen via negative _snprintf return, causing heap out-of-bounds write
- Connector/ODBC: MADB_Stmt::ArrayOffset is not reset when an exception unwinds out of MADB_StmtExecute, so the next paramset reads out of bounds
- Heap Use-After-Free in Materialized_cursor::open via SYS_REFCURSOR Array Reallocation
- MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion
- Connector/C Out-of-bounds read from unterminated GSSAPI SPN in `parse_server_packet()`
- Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path
- Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every call
- Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded name
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.