jackc vulnerabilities

Products

• pgx 6
• github.com/jackc/pgproto3 4

Latest jackc CVEs

Newest publication first

1. CVE-2026-41889 pgx: SQL Injection via placeholder confusion with dollar quoted string literals

   Published 2026-05-08

   Low·CVSS 2.3 EPSS 0.36%

   pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placehol...

2. CVE-2026-33815 CVE-2026-33815 in github.com/jackc/pgx

   Published 2026-04-07

   High·CVSS 8.3 EPSS 0.63%

   Memory-safety vulnerability in github.com/jackc/pgx/v5.

3. CVE-2026-33816 CVE-2026-33816 in github.com/jackc/pgx

   Published 2026-04-07

   High·CVSS 8.3 EPSS 0.58%

   Memory-safety vulnerability in github.com/jackc/pgx/v5.

4. CVE-2026-32286 Denial of service in github.com/jackc/pgproto3/v2

   Published 2026-03-26

   High·CVSS 7.5 EPSS 0.69%

   The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

5. GHSA-fqpg-rq76-99pq Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx

   Published 2024-07-05

   Medium·CVSS 5.3

   Pipeline can panic when PgConn is busy or closed.

6. CVE-2024-27304 pgx SQL Injection via Protocol Message Size Overflow

   Published 2024-03-06

   Critical·CVSS 9.8 EPSS 1.1%

   pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the atta...

7. CVE-2024-27289 pgx SQL Injection via Line Comment Creation

   Published 2024-03-06

   High·CVSS 8.1 EPSS 0.85%

   pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.