Executive brief
ProxySQL is a high-performance database proxy used to manage traffic for MySQL and PostgreSQL databases. A critical vulnerability allows an unauthenticated remote attacker to crash the service or potentially execute arbitrary code by sending a specially crafted initial connection packet. This could lead to a complete service outage or unauthorized access to the database infrastructure.
Technical details
A heap-based buffer overflow (CWE-787) exists in the MySQL_Data_Stream::read_from_net() and PgSQL_Data_Stream::read_from_net() components of ProxySQL. The vulnerability is rooted in the 'first-read' path where the application reads the initial 4 or 5 bytes of a connection, parses a packet length from the attacker-controlled header, and passes this length directly to a subsequent recv() call. Because the destination buffer (queueIN) is a fixed 32 KB heap-allocated queue, providing a length larger than 32,768 bytes results in an out-of-bounds write. This occurs before any authentication or packet validation takes place. The issue is resolved in version 3.0.9 by bounding the recv() size.
Affected products
- sysown ProxySQL >= 2.0.18, < 3.0.9
Timeline
- 2026-05-26: advisory: Internal GHSA advisory published
- 2026-06-04: patched: Version 3.0.9 released with fix
- 2026-06-19: disclosed: Public CVE disclosure