nuget Npgsql vulnerabilities

Latest nuget Npgsql CVEs

Newest publication first

1. CVE-2024-32655 Npgsql Vulnerable to SQL Injection via Protocol Message Size Overflow

   Published 2024-05-09

   High·CVSS 8.1 EPSS 1.7% PoC

   Npgsql is the .NET data provider for PostgreSQL. The WriteBind() method in src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs uses int variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.