CVE-2026-102664

Name of the Vulnerable Software and Affected Versions ProxySQL versions prior to 3.0.10 ProxySQL versions prior to 3.1.10 ProxySQL versions prior to 4.0.10

Description The decompress mysql payload() function in lib/mysql data stream.cpp fails to verify that the actual output length matches the payload length variable when uncompress() returns Z OK. An authenticated MySQL client using compression can provide an inflated payload length, leading the buffer2array() function to process uninitialized heap buffer data as MySQL packet headers. This can result in stale data being forwarded to the backend, potentially disclosing previous SQL queries, credentials, session state, or result data through backend error responses. Additionally, malformed lengths may lead to excessive memory allocations.

Recommendations Update to version 3.0.10. Update to version 3.1.10. Update to version 4.0.10.