CVE-2026-102664 · Package
NO FIX YET · SEE WHAT TO DO
ProxySQL, a proxy in front of MySQL and PostgreSQL, does not check that decompressed MySQL data matches its declared length. An authenticated client using compression can make the proxy forward uninitialized heap memory, which may expose earlier queries, results, credentials or session state.
first public Jul 30, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run ProxySQL in front of MySQL or PostgreSQL databases, where clients connect to the proxy and can negotiate MySQL compression. The sources say the attacker must be an authenticated MySQL client, so exposure depends on who holds database credentials. Deployments that do not run ProxySQL, or that restrict who can connect, are less exposed.
Not affected if auth-required, no-mysql-compression, not-proxysql
Who cares database, mysql, postgresql, proxysql
proxysql --version and compare it with the fixed versions below.3.0.10 on the 3.0 line, 3.1.10 on the 3.1 line, or 4.0.10 on the 4.0 line.ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.