Read the docs
TI-2026-36043 Aliases CVE-2026-48773

ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling

Priority HIGH 82CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and ProxySQL passes that attacker-controlled length directly to `recv()` while writing into a fixed 32 KB input queue. Version 3.0.9 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00689 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed proxysql (sysown): 3.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sysownproxysql2.0.18 to before 3.0.93.0.9Patch availableCNA
  • proxysql Vendorsysown Affected 2.0.18 to before 3.0.9 Fixed in 3.0.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:proxysql:proxysql:*:*:*:*:*:*:*:*2.0.18 to before 3.0.9Vulnerablesysown
  • cpe:2.3:a:proxysql:proxysql:*:*:*:*:*:*:*:* Versions 2.0.18 to before 3.0.9 Vulnerable ·sysown

Remediation

  • Fix · CNA proxysql (sysown) Fixed in 3.0.9

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48773

References

Exploit 1

Other 1

  • TI-2026-36042 ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL CVSS 3.1CRITICAL 10.0
  • TI-2026-36044 ProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences