ydb-platform vulnerabilities

Products

• github.com/ydb-platform/ydb-go-sdk/v3 2
• ydb 1

Latest ydb-platform CVEs

Newest publication first

1. GHSA-28xx-pppm-vqff ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction

   Published 2026-04-30

   Low·CVSS 2.7

   Impact Transactions were NOT committed despite the explicit options.WithCommit flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss o...

2. CVE-2026-24825 a memory leak in ydb-platform/ydb with use of yajl_tree_parse function from src/yail module, which will cause out-of-memory in server and cause crash.

   Published 2026-01-27

   Medium·CVSS 6.9 EPSS 0.37%

   Missing Release of Memory after Effective Lifetime vulnerability in ydb-platform ydb (contrib/libs/yajl modules). This vulnerability is associated with program files yail_tree.C. This issue affects ydb: through 24.4.4.2.

3. CVE-2023-45825 Token in custom credentials object can leak through logs in ydb-go-sdk

   Published 2023-10-19

   Medium·CVSS 5.5 EPSS 0.23%

   ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.