jackc github.com/jackc/pgproto3 vulnerabilities

Latest jackc github.com/jackc/pgproto3 CVEs

Newest publication first

1. CVE-2026-33815 CVE-2026-33815 in github.com/jackc/pgx

   Published 2026-04-07

   High·CVSS 8.3 EPSS 0.63%

   Memory-safety vulnerability in github.com/jackc/pgx/v5.

2. CVE-2026-33816 CVE-2026-33816 in github.com/jackc/pgx

   Published 2026-04-07

   High·CVSS 8.3 EPSS 0.58%

   Memory-safety vulnerability in github.com/jackc/pgx/v5.

3. CVE-2026-32286 Denial of service in github.com/jackc/pgproto3/v2

   Published 2026-03-26

   High·CVSS 7.5 EPSS 0.69%

   The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

4. CVE-2024-27304 pgx SQL Injection via Protocol Message Size Overflow

   Published 2024-03-06

   Critical·CVSS 9.8 EPSS 1.1%

   pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the atta...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.