CVE-2026-102664
Description
A flaw was found in ProxySQL. When processing compressed client traffic, the proxy fails to verify that the actual decompressed data length matches the client-supplied payload size. An authenticated client can exploit this vulnerability by overstating the payload length, causing the proxy to read and forward uninitialized heap memory to the backend database. This issue primarily leads to information disclosure of sensitive data—such as credentials, session state, and previous query results—and can also trigger a denial of service (DoS) through excessive memory allocation.
Statement
Red Hat rates this vulnerability as Important because an authenticated user can remotely trigger an uninitialized memory read that exposes sensitive information, including credentials and database queries from other sessions traversing the proxy. Exploitation requires an authenticated connection and the negotiation of compressed client-server traffic, meaning exposure is limited to valid database users with network access to the proxy service. In typical deployments where database proxies mediate multi-tenant connections, this failure to validate decompressed stream lengths presents a significant risk to data confidentiality across isolated tenant workloads.
Mitigation
Restrict network exposure by limiting access to the ProxySQL listening port (default 6033/tcp) to trusted clients and application servers using firewalld.
1. Allow connections exclusively from authorized subnets and remove public exposure:
# firewall-cmd --permanent --zone=trusted --add-source=<trusted_subnet>
# firewall-cmd --permanent --zone=trusted --add-port=6033/tcp
# firewall-cmd --permanent --zone=public --remove-port=6033/tcp
# firewall-cmd --reload
Caveats:
Network filtering restricts access to authorized IP ranges, but it does not prevent an authenticated user within the trusted network from sending crafted compressed payloads.
Warning: Reloading the firewall configuration can disrupt active network sessions and immediately terminate access for clients outside the designated trusted zone.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict length verification of decompressed zlib output against declared payload length in decompress_mysql_payload before parsing packet buffers: upgrade to ProxySQL 3.0.10, 3.1.10, 4.0.10 (or the fixed Proxysql builds), which verify that the actual decompressed output length from uncompress() matches the claimed destination payload length, closing over-declared payload length in compressed MySQL packets. Until patched, this is a concern on ProxySQL instances processing authenticated MySQL client traffic with compression enabled, so restrict network access to ProxySQL listening ports (such as 6033/tcp) exclusively to trusted hosts using firewall rules and audit authenticated database accounts. These controls limit blast radius and contain exploitation, but they do not fix the underlying unverified decompressed payload length defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other
Technical Impact: Unexpected State; Varies by Context
The consequences vary depending on the type of resource and how it is used within the product.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
