Skip to content
Percona Software for MySQL Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona build of ProxySQL 3.0.9 and ProxySQL admin tools (2026-07-30)

Download Percona’s build of ProxySQL
Install
View the GitHub repository for Percona’s build of ProxySQL

ProxySQL is a high-performance proxy for MySQL and MySQL-compatible database servers such as Percona Server for MySQL and MariaDB. It acts as an intermediary for client requests seeking resources from the database. ProxySQL was created for the database administrator to solve complex replication topology issues. Percona distributes ProxySQL as a repackaged version of the upstream release, without making any code modifications.

You can download the original ProxySQL from GitHub. The ProxySQL documentation provides information on installing and running ProxySQL.

The ProxySQL Admin (proxysql-admin) tool simplifies the configuration of Percona XtraDB Cluster nodes with ProxySQL. ProxySQL Admin supports Percona XtraDB Cluster without custom scripts.

The pxc_scheduler_handler tool can automatically perform a failover due to node failures, service degradation, or maintenance. This tool has features and capabilities that differ from the ProxySQL admin tool, so you should not use options from one tool in the other, as that may cause unintended results.

Release highlights

This release introduces Percona’s build of ProxySQL 3.0.9, incorporating upstream features and improvements.

Instead of releasing a Percona build of ProxySQL 3.0.7 or 3.0.8, we are skipping to 3.0.9. This build includes all enhancements and bug fixes from ProxySQL 3.0.7, ProxySQL 3.0.8, and ProxySQL 3.0.9.

From ProxySQL 3.0.7

ProxySQL 3.0.7 hardens protocol handling, expands TLS observability, and adds zstd compression. The release contributes the following changes:

  • Hardened MySQL protocol handling with validation for COM_CHANGE_USER, HandshakeResponse, and PROXY protocol v1 packet fields. The validation prevents crashes from malformed inputs.

  • Added native zstd compression for the MySQL protocol as an alternative to zlib. zstd delivers higher compression ratios and lower CPU overhead, particularly for high-throughput workloads.

  • Introduced two admin observability tables. The stats_tls_certificates table exposes loaded TLS certificate metadata, including subject, issuer, validity dates, and cipher suites. The stats_proxysql_global table holds global proxy metrics, separating them from stats_mysql_global to remove ambiguity in dual-protocol deployments.

  • Fixed a crash triggered by COM_BINLOG_DUMP when idle backends from other hostgroups were connected. The fix prevents segmentation faults in multi-hostgroup deployments.

  • Fixed an issue where SHOW WARNINGS statements containing inline comments incorrectly incremented warning_count. The query processor uses digest_text to identify these queries, preventing false increments (#5306).

  • Redacted admin credentials in logging output when set through administrative commands. The redaction prevents sensitive authentication data from appearing in log files.

  • Added support for loading REST API routes from configuration aliases, enabling declarative route configuration without manual SQL commands. REST API configuration values are properly escaped during insertion.

  • Added validation for conflicting listener ports at startup. ProxySQL detects and reports port conflicts before entering the main event loop, replacing silent failures with clear error messages.

From ProxySQL 3.0.8

ProxySQL 3.0.8 introduces MySQL session-variable tracking and several MySQL protocol and authentication improvements. The release contributes the following changes:

  • Added MySQL session-variable tracking through the mysql-session_track_system_variables mode (DISABLED, OPTIONAL, or ENFORCED). ProxySQL consumes the MySQL server’s session_track_system_variables and session_track_state_change notifications. Per-server backoff routes around servers that reject the configured set (#5166).

  • Added the mysql-zstd_compression_level global variable, accepting values from 1 to 22 with a default of 3. The variable decouples zstd from mysql-protocol_compression_level. The split removes the v3.0.7 confusion where one variable spanned two algorithms with different level semantics (#5637).

  • Added the mysql-resolution_family global variable, accepting system, ipv4, or ipv6 (default system). The variable produces deterministic IPv4 or IPv6 backend hostname resolution on dual-stack hosts (#5554).

  • Fixed caching_sha2_password authentication for accounts configured with 10000 rounds or more. The rounds field parses as hexadecimal, matching the MySQL specification. CACHING_SHA2_PASSWORD() accepts an optional rounds argument (#5640).

  • Restored upper-word capability bits in the MySQL greeting that an earlier refactor had dropped. The fix repairs negotiation with clients that depend on those bits.

  • Reworked GTID handling around a Gtid_Interval and GTID_Set class hierarchy. The hierarchy de-duplicates and compacts overlapping intervals automatically. Wire-protocol parsing covers I3= (single trxid range with UUID) and I4= (range without UUID) messages from proxysql_mysqlbinlog (#5224, #5557).

  • Added macOS build support so ProxySQL compiles cleanly on Apple Silicon and Intel for development use (#5664).

  • Resolved several MySQL stability issues. The fixes cover MySQL 9.x charset handling in validate_charset and the Group Replication Monitor first-iteration probe. Additional fixes address GTID range validation and a GTID parser NULL check after strchr.

From ProxySQL 3.0.9

ProxySQL 3.0.9 delivers two critical security fixes, pool-contention scheduling, and several MySQL routing and protocol corrections. The release contributes the following changes:

  • Patched CVE-2026-48772, a PROXY protocol v1 flaw in UNKNOWN transport frames. Clients could embed a forged source address and bypass mysql_query_rules.client_addr access controls. ProxySQL discards address fields in UNKNOWN frames.

  • Patched CVE-2026-48773, a pre-authentication heap overflow on the MySQL wire protocol. An unauthenticated client could overflow the buffer during the first recv() on a connection. ProxySQL enforces a maximum size on that initial read.

  • Added a backend-pool session scheduler for saturated connection pools (#5819, #5825). ProxySQL classifies sessions as active, waiting for a backend, or idle on each thread iteration. The scheduler activates when failed get_MyConn_from_pool() calls indicate pool pressure. The session in CONNECTING_SERVER state with the longest wait receives the next available backend connection.

  • Added ParserSQL, an optional abstract syntax tree (AST) parser shipped as a static library (#5736). The legacy parser remains the default. Set mysql-set_parser_algorithm=3 to route only SET statement parsing through ParserSQL. Set mysql-query_processor_parser=1 to route query digest generation, command-type classification, and SET parsing through ParserSQL.

  • Added automatic removal of stale AWS Aurora replicas from mysql_servers (#5760). Replicas absent from REPLICA_HOST_STATUS for autopurge_missing_checks consecutive monitor cycles are purged. The change also resolves a race condition in Aurora replica discovery.

  • Added session tracking for Galera variables wsrep_trx_fragment_size and wsrep_trx_fragment_unit (#5708). ProxySQL captures these values on SET and replays them when swapping backend connections. MariaDB SET STATEMENT var=val ... FOR <query> syntax forwards without pinning the session to a hostgroup. Whitespace-normalized matching covers multiline FOR clauses (#5794).

  • Set the CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA capability bit in the MySQL handshake greeting (#5744). ProxySQL already accepted length-encoded client authentication data but did not advertise the bit. Clients such as Boost.MySQL rejected the connection without the flag.

  • Corrected MariaDB version detection after a MySQL 9.x charset change (#5807). ProxySQL forwarded SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci to MariaDB 10.x and 11.x backends, producing ERROR 1273: Unknown collation. ProxySQL identifies MariaDB separately from MySQL. Related fixes in MySQL_Monitor restore health checks against MySQL 9.x Galera and Percona XtraDB Cluster backends.

  • Corrected mysql_query_rules_fast_routing bypass when no rule matched (#5763). A prior rule with apply=1 could block fast routing even after the matcher found no match. Traffic then routed to default_hostgroup or failed with error 9001.

  • Corrected a double-free in COM_STMT_EXECUTE handling for oversized prepared-statement packets (#5808). Packets exceeding mysql-max_allowed_packet could free the same buffer twice in handler_WCD_SS_MCQ_qpo_LargePacket(). The fault caused intermittent crashes under load.

  • Corrected uneven backend load distribution from an unseeded random number generator (#5743). MySQL server and connection-pool selection used unseeded fastrand() and thread-unsafe rand(). Worker threads produced correlated picks that skewed traffic across equal-weight backends. Selection now uses the seeded rand_fast() generator.

Bug Fixes

  • PSQLADM-574: Add support for Percona XtraDB Cluster 9.6 and 9.7 in proxysql-admin and percona-scheduler-admin

  • PSQLADM-598: Add configurable AUTH_PLUGIN setting and replace hardcoded mysql_native_password in admin tool user creation and client connections.

Additional resources

Last update: 2026-07-30