CVE-2026-48773 Details
Description
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and ProxySQL passes that attacker-controlled length directly to `recv()` while writing into a fixed 32 KB input queue. Version 3.0.9 patches the issue.
A heap memory corruption vulnerability has been identified in ProxySQL, specifically in versions 2.0.18 prior to 3.0.8. This vulnerability exists in the first-read handling of both MySQL and PostgreSQL protocols. A remote, unauthenticated client can exploit this by sending an oversized first packet, which ProxySQL then improperly processes, leading to a heap buffer overflow. The issue has been confirmed with AddressSanitizer on the MySQL frontend listener and the PostgreSQL frontend listener.
Users should upgrade to ProxySQL version 3.0.9, 3.1.9, or 4.0.9, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sysown/proxysql/security/advisories/GHSA-58ww-865x-grpr | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/sysown/proxysql/releases/tag/v3.0.9 | [email protected] | Release Notes |
| https://github.com/sysown/proxysql/security/advisories/GHSA-58ww-865x-grpr | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| proxysql proxysql | >= 2.0.18, < 3.0.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |