Jackc vulnerabilities
We track 4 vulnerabilities in Jackc products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2026.
Latest Jackc vulnerabilities
- 9.8 Critical severity
pgx: Improper Neutralization of Special Elements used in an SQL Command
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be inter
- 7.5 High severity
github.com/jackc/pgproto3/v2: Improper Validation of Array Index
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
- 9.8 Critical severity
pgx: Improper Neutralization of Special Elements used in an SQL Command
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple mes
- 8.1 High severity
pgx: Improper Neutralization of Special Elements used in an SQL Command
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; th