CVE-2026-48773

Name of the Vulnerable Software and Affected Versions ProxySQL versions 2.0.18 through 3.0.8

Description ProxySQL contains a pre-authentication heap memory corruption issue within the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can trigger this by declaring an oversized first packet length. The software then passes this attacker-controlled length directly to the recv() function while writing into a fixed 32 KB input queue.

Recommendations Update to version 3.0.9.