CVE-2026-102664: ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompressmysqlpayload() in lib/mysqldatastream.cpp accepts a zlib stream when uncompress() returns ZOK without checking that the actual output length equals the attacker-controlled payloadlength. An authenticated MySQL client that negotiates compression can overstate payloadlength, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ProxySQLto a version that resolves this vulnerability.Fixed in 3.0.10 - Upgrade
Upgrade
ProxySQLto a version that resolves this vulnerability.Fixed in 3.1.10 - Upgrade
Upgrade
ProxySQLto a version that resolves this vulnerability.Fixed in 4.0.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MySQL client that can connect through ProxySQL and negotiate MySQL protocol compression can exploit it. The attack is network-reachable and requires low privileges, but does not require user interaction.
Are default deployments affected?
Only connections using the MySQL compression path are described as affected. The provided information does not establish whether compression is enabled or negotiated by default in a given ProxySQL deployment.
What versions contain the fix?
Upgrade to ProxySQL 3.0.10, 3.1.10, or 4.0.10, as applicable. Versions earlier than those releases are affected.
What is the impact if exploitation succeeds?
ProxySQL may parse uninitialized heap memory as MySQL packet headers and forward stale data to the backend. Resulting backend error responses may disclose prior SQL queries, result data, credentials, or session state; malformed lengths can also trigger excessive allocations.