What is the CVSS score of CVE-2026-48773?

CVE-2026-48773 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of ProxySQL are affected by CVE-2026-48773?

ProxySQL database proxy versions 2.0.18 through 3.0.8 are vulnerable to pre-authentication attacks that could disable database connectivity or compromise the integrity of all database transactions…. A patch is available.

How to fix or mitigate CVE-2026-48773?

Within 24 hours: Identify all systems running affected ProxySQL versions (2.0.18-3.0.8) and document their role in production database infrastructure. Within 7 days: Upgrade all affected instances to ProxySQL 3.0.9. Within 30 days: Verify all upgrades are complete, monitor access logs for exploitation attempts, and validate database connectivity and performance.

ProxySQL CVE-2026-48773

EUVD-2026-38073 CRITICAL

Out-of-bounds Write (CWE-787)

2026-06-19 GitHub_M

PostgreSQL Memory Corruption Buffer Overflow Proxysql

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Pre-authentication first-read path reached over the network with no user interaction (AV:N/AC:L/PR:N/UI:N); heap OOB write plausibly yields RCE, so C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 21:02 EUVD

Analysis Generated

Jun 19, 2026 - 20:16 vuln.today

CVE Published

Jun 19, 2026 - 19:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and ProxySQL passes that attacker-controlled length directly to recv() while writing into a fixed 32 KB input queue. Version 3.0.9 patches the issue.

Articles & Coverage 2

News 3 New PostgreSQL Vulnerabilities - 2 Critical, 1 High Severity Jun 20, 2026 News Critical Heap Corruption in ProxySQL (PostgreSQL Protocol) - CVE-2026-48773 Jun 19, 2026

AnalysisAI

Pre-authentication heap memory corruption in ProxySQL 2.0.18 through 3.0.8 allows remote unauthenticated attackers to corrupt heap memory by sending a crafted first packet declaring an oversized length, which is passed directly to recv() into a fixed 32 KB input queue on both MySQL and PostgreSQL protocol listeners. The flaw carries a CVSS 9.8 rating and is fixed in 3.0.9; no public exploit identified at time of analysis, but the trivial trigger condition and out-of-bounds write primitive create strong potential for weaponization.

Technical ContextAI

ProxySQL is a high-performance database proxy used in front of MySQL/MariaDB and PostgreSQL clusters for connection pooling, query routing, and failover. The vulnerability is a CWE-787 out-of-bounds write rooted in how the protocol front-ends parse the first packet header on a new client connection: a length field controlled by the client is passed directly to recv() while the destination buffer is a fixed 32 KB input queue, so any declared length larger than the buffer results in a heap write past the queue's bounds. Both the MySQL wire protocol listener and the PostgreSQL protocol listener share this defective first-read path, broadening the attack surface to any TCP port ProxySQL exposes for client traffic. The CPE cpe:2.3:a:sysown:proxysql:*:*:*:*:*:*:*:* confirms the upstream sysown/proxysql codebase is affected across the named range.

RemediationAI

Vendor-released patch: ProxySQL 3.0.9 - upgrade all affected instances to 3.0.9 or later as the primary remediation, per https://github.com/sysown/proxysql/releases/tag/v3.0.9 and the advisory at https://github.com/sysown/proxysql/security/advisories/GHSA-58ww-865x-grpr. Until the upgrade is rolled out, restrict network reachability of the ProxySQL client-facing ports (default 6033 for MySQL, plus any configured PostgreSQL listener) to known application subnets via firewall or security-group rules, since the bug triggers pre-authentication and IP allowlisting is the only effective compensating control; this trades off operational flexibility for clients connecting from new networks. Disabling the PostgreSQL listener if unused removes one of the two vulnerable code paths but does not fix the MySQL path. Front-ending ProxySQL with a TLS-terminating proxy that performs strict client certificate authentication can blunt opportunistic scanning but does not mitigate exploitation by any attacker able to complete the TCP handshake, so it is not a substitute for patching.