---
id: "CVE-2026-102664"
kind: "vulnerability"
aliases: ["CVE-2026-102664"]
title: "ProxySQL: compressed MySQL packets leak heap data to clients"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "package", "postgresql", "proxysql"]
not_affected_if: ["auth-required", "no-mysql-compression", "not-proxysql"]
published_at: "2026-11-04T21:17:41+00:00"
first_seen_at: "2026-11-04T21:49:17+00:00"
updated_at: "2026-11-04T21:51:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102664", "first_seen_at": "2026-11-04T21:49:17+00:00"}]
exploit_sources: []
---

# ProxySQL: compressed MySQL packets leak heap data to clients

ProxySQL, a proxy in front of MySQL and PostgreSQL, does not check that decompressed MySQL data matches its declared length. An authenticated client using compression can make the proxy forward uninitialized heap memory, which may expose earlier queries, results, credentials or session state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ProxySQL version with `proxysql --version` and compare it with the fixed versions below.
- Look for MySQL compression enabled on client connections in the ProxySQL configuration.

## Fix

- Move to `3.0.10` on the 3.0 line, `3.1.10` on the 3.1 line, or `4.0.10` on the 4.0 line.

## Timeline

- 2026-11-04T21:49:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102664

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx
- [fix] Patch: github.com https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724
- [fix] Patch: github.com https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520
- [fix] Release notes: github.com https://github.com/sysown/proxysql/releases/tag/v3.0.10
- [fix] Release notes: github.com https://github.com/sysown/proxysql/releases/tag/v3.1.10
- [fix] Release notes: github.com https://github.com/sysown/proxysql/releases/tag/v4.0.10

## From the sources

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_