What’s Vulnerable › Vulnerabilities

CVE-2026-48773: ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-19 · updated 2026-10-25
• Weakness: CWE-787

Description

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and ProxySQL passes that attacker-controlled length directly to `recv()` while writing into a fixed 32 KB input queue. Version 3.0.9 patches the issue.

Affected products

• sysown proxysql: from 2.0.18 before 3.0.9 — fixed in 3.0.9

How to fix

Upgrade to a fixed version: sysown proxysql 3.0.9. Check the vendor advisory for mitigations.

References

• https://github.com/sysown/proxysql/releases/tag/v3.0.9
• https://github.com/sysown/proxysql/security/advisories/GHSA-58ww-865x-grpr
• https://github.com/sysown/proxysql/security/advisories/GHSA-58ww-865x-grpr

Get alerted when CVE-2026-48773 or the next vulnerability affects your stack