CVE-2026-48773: ProxySQL Pre-Authentication Out-of-Bounds Write in MySQL and PostgreSQL Protocol Handling
ProxySQL versions from 2.0.18 up to 3.0.8 contain a pre-authentication out-of-bounds write (CWE-787) in the first-read paths of their MySQL and PostgreSQL protocol handling. The NVD record rates it critical with a CVSS 3.1 base score of 9.8 and a network, no-privilege, no-interaction vector. Version 3.0.9 is stated to patch the issue, and no confirmed exploitation appears in the sources consulted.
Overview
ProxySQL is a proxy for MySQL, its forks and PostgreSQL. According to the GitHub Security Advisory referenced in the record, versions from 2.0.18 through 3.0.8 contain a pre-authentication heap memory corruption issue in the first-read paths of the MySQL and PostgreSQL protocol handling. The NVD classification is out-of-bounds write (CWE-787).
Impact
The record states that a remote, unauthenticated client can trigger the condition by declaring an oversized first packet length. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H corresponds to a critical base score of 9.8 in the record, which indicates high potential impact on confidentiality, integrity and availability. The concrete consequences in a given deployment are not described in the sources and would depend on configuration.
Affected products and versions
- Product in the CNA data: Proxysql Proxysql.
- Recorded affected range: 2.0.18 or later and before 3.0.9.
- Fixed in: 3.0.9, as stated in the record and the release reference.
- The record does not state whether versions before 2.0.18 are affected.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation is not reported by KEV. The GitHub reference is tagged Exploit in the reference list, but the record provides no exploit details. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade ProxySQL to version 3.0.9 or later. This is the fix identified in the record.
- If upgrading is not immediately possible, review the mitigation guidance in the GitHub Security Advisory. The record does not describe its contents.
- Restrict network reachability of ProxySQL listener ports to trusted application hosts and administrative networks. This general hardening step reduces exposure but is not a substitute for patching.
- Inventory all ProxySQL instances, including forks and containers, to confirm which run versions in the affected range.
Detection guidance
- Review ProxySQL logs and service health for unexpected crashes, restarts or memory errors on exposed instances.
- Where network monitoring is available, look for anomalous connections to ProxySQL listener ports, including unusually large initial packets from untrusted sources.
- Track version inventory so that any instance still in the affected range is identified quickly.
Limitations of the available information
- The record contains no exploit analysis, proof of concept details or observed attack data, and none are provided here.
- No EPSS score or SSVC decision is present in the record, so exploitation likelihood is unknown.
- The record does not describe the contents of the mitigation guidance or whether branches other than 3.0.9 receive separate patches.
- The title was missing from the source record and is supplied by this analysis.
Frequently asked questions
Is this vulnerability being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Follow the official advisories for any changes.
Which version fixes the issue?
The record states that version 3.0.9 patches the issue. Upgrading to 3.0.9 or later is the action identified in the sources.
How severe is it?
The NVD record shows a CVSS 3.1 base score of 9.8, rated critical, with a network attack vector and no privileges or user interaction required.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.