magic asyncpg vulnerabilities

Latest magic asyncpg CVEs

Newest publication first

1. CVE-2020-17446 Asyncpg Arbitrary Code Execution Via Access to an Uninitialized Pointer

   Published 2020-08-12

   Critical·CVSS 9.8 EPSS 2.4%

   asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.