A remote, unauthenticated attacker can send an oversized first packet length when communicating with ProxySQL over the MySQL or PostgreSQL protocol. The vulnerability arises from ProxySQL passing the attacker-controlled length directly to the recv() call while writing into a fixed 32‑kilobyte input queue, resulting in a pre‑authentication heap memory corruption (CWE‑787). This overflow can corrupt control data or other heap objects, potentially allowing an attacker to alter execution flow or execute arbitrary code on the target system.

The affected product is ProxySQL by Sysown. Versions from 2.0.18 through 3.0.8 are vulnerable, while version 3.0.9 applies the fix. The vulnerability exists in the first‑read paths for both MySQL and PostgreSQL protocols.

The CVSS score is 9.8, indicating very high severity. The vulnerability is exploitable by any unauthenticated client that can reach the ProxySQL instance, so it is a pure remote attack vector. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. Given its pre‑authentication nature and lack of mitigations besides the patch, it poses a significant risk to confidentiality, integrity, and availability of affected deployments.