CVE-2026-102664

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102664", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T15:56:02.102Z", "datePublished": "2026-11-04T20:42:25.887Z", "dateUpdated": "2026-11-09T16:58:32.215Z"}, "containers": {"cna": {"title": "ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path", "problemTypes": [{"descriptions": [{"cweId": "CWE-908", "lang": "en", "description": "CWE-908: Use of Uninitialized Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx"}, {"name": "https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724", "tags": ["x_refsource_MISC"], "url": "https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724"}, {"name": "https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520", "tags": ["x_refsource_MISC"], "url": "https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520"}, {"name": "https://github.com/sysown/proxysql/releases/tag/v3.0.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/sysown/proxysql/releases/tag/v3.0.10"}, {"name": "https://github.com/sysown/proxysql/releases/tag/v3.1.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/sysown/proxysql/releases/tag/v3.1.10"}, {"name": "https://github.com/sysown/proxysql/releases/tag/v4.0.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/sysown/proxysql/releases/tag/v4.0.10"}], "affected": [{"vendor": "sysown", "product": "proxysql", "versions": [{"version": "< 3.0.10", "status": "affected"}, {"version": ">= 3.1.0, < 3.1.10", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T20:42:25.887Z"}, "descriptions": [{"lang": "en", "value": "ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10."}], "source": {"advisory": "GHSA-fvch-fpgq-pwfx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:09:27.461578Z", "id": "CVE-2026-102664", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:58:32.215Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102664", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:09:27.461578Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:09:28.624Z"}}], "cna": {"title": "ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path", "source": {"advisory": "GHSA-fvch-fpgq-pwfx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "sysown", "product": "proxysql", "versions": [{"status": "affected", "version": "< 3.0.10"}, {"status": "affected", "version": ">= 3.1.0, < 3.1.10"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.10"}]}], "references": [{"url": "https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx", "name": "https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724", "name": "https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520", "name": "https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sysown/proxysql/releases/tag/v3.0.10", "name": "https://github.com/sysown/proxysql/releases/tag/v3.0.10", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sysown/proxysql/releases/tag/v3.1.10", "name": "https://github.com/sysown/proxysql/releases/tag/v3.1.10", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sysown/proxysql/releases/tag/v4.0.10", "name": "https://github.com/sysown/proxysql/releases/tag/v4.0.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T20:42:25.887Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102664", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:58:32.215Z", "dateReserved": "2026-09-29T15:56:02.102Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T20:42:25.887Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "proxysql", "vendor": "sysown", "versions": [{"status": "affected", "version": "< 3.0.10"}, {"status": "affected", "version": ">= 3.1.0, < 3.1.10"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10."}], "id": "CVE-2026-102664", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102664", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:09:27.461578Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:17:41.300", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724"}, {"source": "security-advisories@github.com", "url": "https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520"}, {"source": "security-advisories@github.com", "url": "https://github.com/sysown/proxysql/releases/tag/v3.0.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/sysown/proxysql/releases/tag/v3.1.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/sysown/proxysql/releases/tag/v4.0.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "proxysql: proxysql: Information disclosure via unverified compressed payload length", "id": "2567440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567440"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "status": "draft"}, "cwe": "CWE-908", "details": ["ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10.", "A flaw was found in ProxySQL. When processing compressed client traffic, the proxy fails to verify that the actual decompressed data length matches the client-supplied payload size. An authenticated client can exploit this vulnerability by overstating the payload length, causing the proxy to read and forward uninitialized heap memory to the backend database. This issue primarily leads to information disclosure of sensitive data\u2014such as credentials, session state, and previous query results\u2014and can also trigger a denial of service (DoS) through excessive memory allocation."], "mitigation": {"lang": "en:us", "value": "Restrict network exposure by limiting access to the ProxySQL listening port (default 6033/tcp) to trusted clients and application servers using firewalld.\n1. Allow connections exclusively from authorized subnets and remove public exposure:\n```\n# firewall-cmd --permanent --zone=trusted --add-source=<trusted_subnet>\n# firewall-cmd --permanent --zone=trusted --add-port=6033/tcp\n# firewall-cmd --permanent --zone=public --remove-port=6033/tcp\n# firewall-cmd --reload\n```\nCaveats:\nNetwork filtering restricts access to authorized IP ranges, but it does not prevent an authenticated user within the trusted network from sending crafted compressed payloads.\nWarning: Reloading the firewall configuration can disrupt active network sessions and immediately terminate access for clients outside the designated trusted zone."}, "name": "CVE-2026-102664", "public_date": "2026-11-04T20:42:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102664\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102664\nhttps://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724\nhttps://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520\nhttps://github.com/sysown/proxysql/releases/tag/v3.0.10\nhttps://github.com/sysown/proxysql/releases/tag/v3.1.10\nhttps://github.com/sysown/proxysql/releases/tag/v4.0.10\nhttps://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx"], "statement": "Red Hat rates this vulnerability as Important because an authenticated user can remotely trigger an uninitialized memory read that exposes sensitive information, including credentials and database queries from other sessions traversing the proxy. Exploitation requires an authenticated connection and the negotiation of compressed client-server traffic, meaning exposure is limited to valid database users with network access to the proxy service. In typical deployments where database proxies mediate multi-tenant connections, this failure to validate decompressed stream lengths presents a significant risk to data confidentiality across isolated tenant workloads.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.1.0,3.1.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "proxysql", "source": "cna", "vendor": "sysown"}, "product": "proxysql", "vendor": "sysown"}], "created": "2026-11-04T21:45:14.731523+00:00", "updated": "2026-11-04T22:00:18.071926+00:00", "vendors": ["sysown", "sysown$PRODUCT$proxysql"]}