CVE-2026-4746: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-4746 is an Out-of-bounds Write vulnerability (CWE-787) in the inflate.C file within the base/poco/Foundation/src module of timeplus-io Proton, an open-source streaming SQL engine. The vulnerability stems from a cloned implementation of the inflate() function sourced from madler/zlib, which was originally reported as CVE-2022-37434. All versions of Proton before 1.6.16 are affected. It was published on March 24, 2026, and carries a CVSS v4.0 base score of 10.0 (Critical) (ENISA EUVD, GitHub PR).

The root cause is an out-of-bounds write (CWE-787) in a cloned inflate() function in base/poco/Foundation/src/inflate.c, which was copied from the madler/zlib library. The original zlib bug — a heap buffer overflow triggered when processing a specially crafted gzip header extra field — was fixed upstream in madler/zlib via commit eff308a, but the fix was not applied to the Proton codebase until PR #943. An attacker can exploit this by supplying a maliciously crafted gzip-compressed payload that triggers the out-of-bounds write during decompression, requiring no authentication, no user interaction, and no special privileges. The fix was contributed by an external researcher (npt-1707) and merged on May 30, 2025 (GitHub PR, ENISA EUVD).

Successful exploitation of this vulnerability can result in high impact to confidentiality, integrity, and availability of the affected system. An attacker could achieve arbitrary code execution by corrupting memory through the out-of-bounds write, potentially leading to unauthorized access to sensitive data, data corruption, or complete service disruption. Given the network-accessible attack vector with no authentication or user interaction required, the blast radius extends to any Proton instance exposed to untrusted input, including downstream systems that may rely on the compromised service (ENISA EUVD).

1. Reconnaissance: Identify internet-facing or network-accessible Proton instances running versions before 1.6.16 using service discovery tools (e.g., Shodan, Censys) or by querying version endpoints.
2. Craft malicious payload: Construct a specially crafted gzip-compressed data stream with a malformed or oversized gzip header extra field, designed to trigger the out-of-bounds write in the inflate() function — mirroring the original CVE-2022-37434 exploit technique.
3. Deliver payload: Submit the malicious gzip payload to any Proton endpoint or interface that processes compressed data (e.g., compressed query inputs, data ingestion APIs), requiring no authentication.
4. Trigger out-of-bounds write: The vulnerable inflate() function processes the malformed gzip header, writing data beyond the intended memory buffer boundaries.
5. Achieve code execution or denial of service: Depending on memory layout and heap state, the attacker may achieve arbitrary code execution, crash the service, or corrupt data structures for further exploitation (GitHub PR, ENISA EUVD).

• Network: Unusual or malformed gzip-compressed data streams sent to Proton ingestion or query endpoints; unexpected outbound connections from the Proton process to unknown external IPs.
• Process: Proton process crashes or unexpected restarts; unusual child processes spawned by the Proton service (e.g., shell processes, network utilities).
• Logs: Application error logs showing decompression failures, memory access violations, or segmentation faults in the inflate function; repeated malformed request errors from a single source IP.
• File System: Unexpected new files or scripts written to the Proton working directory or temp directories; modified binaries or configuration files associated with the Proton service.

The primary remediation is to upgrade timeplus-io Proton to version 1.6.16 or later, which includes the patch applied via PR #943 that backports the upstream zlib fix (commit eff308a from madler/zlib). As a temporary workaround, implement network-level controls to restrict access to Proton instances from untrusted sources, limiting exposure to the vulnerable decompression code path. Monitor systems for signs of exploitation or anomalous behavior while patching is underway (GitHub PR, ENISA EUVD).

The vulnerability was assigned by GovTech CSG and received automated coverage from vulnerability aggregators including ENISA EUVD, VulDB, and CVEFeed shortly after publication. A Bluesky post from a CVE tracking account noted the disclosure. No significant vendor statements, named researcher commentary, or major media coverage beyond automated aggregation has been identified for this CVE (ENISA EUVD, VulDB).