CVE-2026-102664

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompressmysqlpayload in lib/mysqldatastream.cpp accepts a zlib stream when uncompress returns ZOK without checking that the actual output length equals the attacker-controlled payloadlength...

CVE-2026-102664

ProxySQL versions prior to 3.0.10 , 3.1.10 , and 4.0.10 are vulnerable to an uninitialized heap read during MySQL compressed packet decompression via the zlib path. The root cause is located in decompress_mysql_payload() within lib/mysql_data_stream.cpp, which fails to verify that the actual outp...

CVE-2026-102664 ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompressmysqlpayload in lib/mysqldatastream.cpp accepts a zlib stream when uncompress returns ZOK without checking that the actual output length equals the attacker-controlled payloadlength...