CVE-2026-48773: ProxySQL Buffer Overflow Vulnerability

CVE-2026-48773 Overview

CVE-2026-48773 is a pre-authentication heap memory corruption vulnerability in ProxySQL, a high-performance proxy for MySQL, MySQL forks, and PostgreSQL. The flaw affects versions 2.0.18 through 3.0.8 and exists in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated attacker can declare an oversized first packet length, which ProxySQL passes directly to recv() while writing into a fixed 32 KB input queue. This out-of-bounds write [CWE-787] corrupts adjacent heap memory. Version 3.0.9 patches the issue.

Critical Impact
Unauthenticated remote attackers can corrupt heap memory in ProxySQL, potentially enabling denial of service or arbitrary code execution against database proxy infrastructure.

Affected Products

ProxySQL versions 2.0.18 through 3.0.8
MySQL protocol first-read path
PostgreSQL protocol first-read path

Discovery Timeline

2026-06-19 - CVE-2026-48773 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48773

Vulnerability Analysis

The vulnerability resides in the first-read code paths that handle initial protocol negotiation for both MySQL and PostgreSQL clients. ProxySQL allocates a fixed-size 32 KB input queue to buffer the first packet from a connecting client. The server reads the client-declared packet length field and uses that attacker-controlled value as the size argument to recv(). No validation enforces that the declared length fits within the 32 KB buffer. As a result, an attacker who declares a length larger than the queue capacity triggers an out-of-bounds heap write when recv() populates the buffer beyond its bounds.

The issue is exploitable before any authentication occurs, since protocol parsing happens during the initial handshake. Any network-reachable ProxySQL instance is exposed.

Root Cause

The root cause is missing bounds validation between the client-supplied packet length and the fixed allocation size of the input queue. The code path trusts the declared length and forwards it to recv() without clamping it to the buffer capacity. This is a classic out-of-bounds write pattern classified under [CWE-787].

Attack Vector

Exploitation requires only network access to the ProxySQL listener for the MySQL or PostgreSQL protocol. The attacker opens a TCP connection and sends a malformed first packet whose length header exceeds 32 KB. ProxySQL invokes recv() with the oversized length, writing attacker-controlled bytes past the end of the 32 KB heap allocation. Depending on heap layout, the corruption can lead to crashes, denial of service, or memory disclosure and code execution scenarios.

No authentication, credentials, or user interaction are required. See the GitHub Security Advisory GHSA-58ww-865x-grpr for the vendor description.

Detection Methods for CVE-2026-48773

Indicators of Compromise

Unexpected crashes or restarts of the proxysql process, particularly during connection establishment
Connections to the ProxySQL MySQL listener (default port 6033) or PostgreSQL listener (default port 6133) from unexpected source addresses
Malformed protocol handshake packets with declared lengths exceeding 32768 bytes
Core dumps or segmentation faults referencing the input queue buffer in ProxySQL logs

Detection Strategies

Inspect network traffic to ProxySQL listeners for MySQL and PostgreSQL packets whose length field exceeds 32 KB during the first read of a session.
Monitor ProxySQL process health and restart frequency, since heap corruption frequently manifests as crashes before any successful exploitation.
Enable verbose connection logging in ProxySQL to capture client addresses that produce parser errors on the first packet.

Monitoring Recommendations

Alert on repeated short-lived connections from a single source that terminate before authentication completes.
Track ProxySQL version inventory and flag any host running a release earlier than 3.0.9.
Forward ProxySQL stderr and systemd journal entries to a centralized log platform and alert on SIGSEGV or SIGABRT terminations.

How to Mitigate CVE-2026-48773

Immediate Actions Required

Upgrade all ProxySQL instances to version 3.0.9 or later. The release is available at ProxySQL Release v3.0.9.
Restrict network exposure of ProxySQL listeners to trusted application subnets using firewall rules or security groups.
Audit running ProxySQL versions across the fleet and prioritize remediation for internet-exposed nodes.

Patch Information

The maintainers fixed the issue in ProxySQL 3.0.9 by validating the declared first-packet length against the input queue capacity before invoking recv(). Operators running any version from 2.0.18 through 3.0.8 should upgrade. Patch notes and the fix commit are referenced in the GitHub Security Advisory GHSA-58ww-865x-grpr.

Workarounds

Place ProxySQL behind a network access control list that only permits connections from known application servers until patching completes.
Disable the PostgreSQL listener if it is not in use, reducing the attack surface to the MySQL protocol path.
Deploy host-based intrusion prevention rules that drop MySQL or PostgreSQL handshake packets with length fields above 32768 bytes.

bash

# Configuration example: restrict ProxySQL listeners to trusted application subnet
# Replace 10.0.10.0/24 with your application tier CIDR
iptables -A INPUT -p tcp --dport 6033 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6133 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6033 -j DROP
iptables -A INPUT -p tcp --dport 6133 -j DROP