CVE-2026-48773
Critical
Description
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and ProxySQL passes that attacker-controlled length directly to `recv()` while writing into a fixed 32 KB input queue. Version 3.0.9 patches the issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductProxysql
PublishedJun 19, 2026
First seenJun 19, 2026
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- proxysql proxysql3.0.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| proxysql proxysql | 2.0.18 ≤ v < 3.0.9 | 3.0.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.