Detections
Analytics

SCA: security update for mariadb (GHSA-cx2f-j9fh-8g68)

medium Tenable Self-Hosted Container Security Plugin ID 473961

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL
 databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls
 Ed25519PasswordAuth.hash() through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash()
 references a seed identifier that is not in scope. Exposure requires a MariaDB server reached over TCP,
 TLS enabled with ssl: true or an ssl object whose rejectUnauthorized value is not false, a password set,
 no ssl.ca configured, and client_ed25519 negotiated as the authentication plugin. Under those conditions,
 a legitimate server, malicious server, or network attacker presenting a self-signed certificate can reach
 this path and cause a synchronous ReferenceError to escape the socket data handler. Under Node.js default
 uncaught-exception behavior, the client process terminates, causing denial of service. Configurations
 using a provided CA, rejectUnauthorized: false, another authentication plugin, or a Unix socket do not
 reach this vulnerable path. This issue is fixed in version 3.5.4. (CVE-2026-107382)

Solution

Update the mariadb library and its related packages to version 3.5.4 or later.

See Also

https://github.com/advisories/GHSA-cx2f-j9fh-8g68

Plugin Details

Severity: Medium

ID: 473961

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/9/2026

Updated: 10/9/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-107382

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/8/2026

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-107382

cwe: CWE-248