Quick answers
- Is CVE-2026-48773 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48773 being exploited in the wild.
- How severe is CVE-2026-48773?
- Critical severity, with a CVSS score of 9.8, published 19 June 2026.
- Which products and versions are affected?
- ProxySQL >= 2.0.18, < 3.0.9.
- Is there a fix for CVE-2026-48773?
- A patch was published on 2026-06-04: Version 3.0.9 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48773 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-48773?
- Check whether you run ProxySQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow (CWE-787) exists in the MySQL_Data_Stream::read_from_net() and PgSQL_Data_Stream::read_from_net() components of ProxySQL. The vulnerability is rooted in the 'first-read' path where the application reads the initial 4 or 5 bytes of a connection, parses a packet length from the attacker-controlled header, and passes this length directly to a subsequent recv() call. Because the destination buffer (queueIN) is a fixed 32 KB heap-allocated queue, providing a length larger than 32,768 bytes results in an out-of-bounds write. This occurs before any authentication or packet validation takes place. The issue is resolved in version 3.0.9 by bounding the recv() size.
Affected products
- sysown ProxySQL >= 2.0.18, < 3.0.9
Timeline
- 2026-05-26: advisory: Internal GHSA advisory published
- 2026-06-04: patched: Version 3.0.9 released with fix
- 2026-06-19: disclosed: Public CVE disclosure