October 23, 2026 by Rene Cannao · Release
#proxysql-2-7 #security #mysql #open-source

Announcing ProxySQL 2.7.4: Security and Severe Bug Fixes Only

ProxySQL 2.7.4 is now available. This release contains only security fixes and severe bug fixes for the 2.7 LTS series. It is a focused maintenance update for existing 2.7 deployments, with no new features.

We recommend that users running earlier 2.7 releases prioritize this update. The fixes address vulnerabilities in MySQL protocol handling, memory corruption that can crash the proxy, and a transaction-state error that can return a backend connection to the pool while a transaction is still open.

Security fixes

ProxySQL 2.7.4 brings security fixes from the newer release line to the 2.7 codebase. It addresses 15 published security advisories, including vulnerabilities reachable before authentication.

The fixes cover:

  • MySQL authentication and packet parsing: validate field lengths and packet boundaries before reading authentication data, statement identifiers, and prepared-statement parameters.
  • Compressed MySQL traffic: validate declared and decompressed lengths, prevent buffer overflows in the uncompressed fallback, and handle inner packet headers split across compressed frames without aborting the process.
  • PROXY protocol v1: bound address parsing and prevent address fields in UNKNOWN headers from spoofing the client address used by access rules and logs. These fixes apply to deployments accepting PROXY protocol traffic.
  • Local file-loading policy: enforce the refusal of LOAD DATA LOCAL INFILE on the prepared-statement path, including comment-prefixed statements and LOAD XML LOCAL INFILE.

The full release notes list the individual advisories and CVE identifiers.

Severe bug fixes

Prevent prepared-statement double frees

When ProxySQL answers a prepared-statement execution without sending it to a backend, the client packet must be released exactly once. Several early-response paths could free the same packet twice, corrupting memory and potentially crashing the proxy.

This release fixes packet ownership for query-rule responses, oversized packets, and hostgroup-lock errors, along with related prepared-statement cleanup and long-data ownership errors.

Preserve transaction state after a failed execution

A failed prepared-statement execution could lose the connection’s transaction status during cleanup. In particular, a failure at the start of an implicit transaction with autocommit=0 could cause a backend connection with an open transaction to return to the pool. A subsequent client ROLLBACK could also be filtered instead of reaching the backend.

ProxySQL 2.7.4 preserves that transaction state through cleanup so the connection remains associated with the active transaction and ROLLBACK reaches the backend.

Upgrade within the 2.7 series

Signed DEB and RPM packages for x86_64 and ARM64 are available from the ProxySQL 2.7.4 GitHub release and the 2.7 APT/RPM repositories.

Use the 2.7 repository track when updating an existing 2.7 deployment. After upgrading, proxysql --version should report the release build 2.7.4-29-gbc3e363.