Pgproto3 vulnerabilities

2 known vulnerabilities in Pgproto3 from Jackc. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  github.com/jackc/pgproto3/v2: Improper Validation of Array Index

  CVE-2026-32286Mar 26, 2026Github.com/jackc/pgproto3/v2

  The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

• 9.8 Critical severity

  pgx: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-27304Mar 6, 2024JackcEPSS 1.11%

  pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple mes