CVE-2026-48773: ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling

Synopsis

A heap memory corruption vulnerability affects ProxySQL versions 2.0.18 through 3.0.8 in the MySQL and PostgreSQL protocol first-packet handling path. A remote, unauthenticated attacker can send a crafted first packet with an oversized declared length, causing ProxySQL to write beyond a fixed 32 KB input queue buffer before any authentication check runs. Successful exploitation gives an attacker the ability to read sensitive data, modify in-flight or persisted data, or crash the proxy service entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ProxySQL listener over the network; no local or physical access is needed.

• AuthenticationNot required

  The vulnerability is triggered in the pre-authentication first-packet path, so no credentials of any kind are required.

• Victim interactionNot required

  No user or administrator action is needed; the attacker sends a single malformed packet to trigger the overflow.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, specific memory layout, or environmental dependency is required.

Blast Radius

• An attacker can read heap memory contents from the ProxySQL process, which may include in-flight credentials, query text, and session tokens.
• An attacker can corrupt heap structures to manipulate ProxySQL's query routing or inject modified SQL payloads toward backend databases.
• An attacker can crash the ProxySQL process, dropping all proxied database connections and making backend databases unreachable to applications relying on the proxy.
• Because exploitation requires no authentication, any network-exposed ProxySQL instance in the affected version range is reachable by an unauthenticated external attacker.