ProxySQL uninitialized heap read in MySQL compressed packet handling
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
ProxySQL versions before 3.0.10, from 3.1.0 before 3.1.10, and from 4.0.0 before 4.0.10 are affected. In decompress_mysql_payload() in lib/mysql_data_stream.cpp, a zlib stream is accepted without checking that the decompressed length matches the attacker-controlled payload length, which is a use of uninitialized resource (CWE-908). An authenticated MySQL client that negotiates compression can overstate the payload length, so ProxySQL parses uninitialized heap memory as packet headers and forwards stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can cause excessive allocations.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sysown | proxysql | before 3.0.10; 3.1.0 to before 3.1.10; 4.0.0 to before 4.0.10 | 3.0.10, 3.1.10, 4.0.10 | Patch available | CNA |
- proxysql Vendorsysown Affected before 3.0.10; 3.1.0 to before 3.1.10; 4.0.0 to before 4.0.10 Fixed in 3.0.10, 3.1.10, 4.0.10 Patch available CNA
Remediation
Upgrade ProxySQL to version 3.0.10, 3.1.10, or 4.0.10, which fix the issue. Red Hat lists one product as not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA proxysql (sysown) Fixed in 3.0.10, 3.1.10, 4.0.10
Vendor assessments
Timeline
- 2026-11-04 Threatist record created from CVE-2026-102664
- 2026-11-06 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 6
- https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx
- https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724
- https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520
- https://github.com/sysown/proxysql/releases/tag/v3.0.10
- https://github.com/sysown/proxysql/releases/tag/v3.1.10
- https://github.com/sysown/proxysql/releases/tag/v4.0.10
More sysown vulnerabilities
- TI-2026-36043 ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling CVSS 3.1CRITICAL 9.8
- TI-2026-36042 ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL CVSS 3.1CRITICAL 10.0
- TI-2026-36044 ProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract CVSS 3.1HIGH 7.5
Sources
- CVE-2026-102664 · CVE Program
- CVE-2026-102664 · NVD
- FIRST EPSS
- CVE-2026-102664 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences