CVE-2026-32286: Denial of service in github.com/jackc/pgproto3/v2

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-26 · updated 2026-09-10
Weakness: CWE-129

Description

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

Affected products

github.com/jackc/pgproto3/v2: from 2.0.0 through 2.3.3

References

https://github.com/advisories/GHSA-jqcq-xjh3-6g23
https://github.com/golang/vulndb/issues/4518
https://github.com/jackc/pgx/issues/2507
https://pkg.go.dev/vuln/GO-2026-4518
https://access.redhat.com/errata/RHSA-2026:11070
https://access.redhat.com/errata/RHSA-2026:11217
https://access.redhat.com/errata/RHSA-2026:11856
https://access.redhat.com/errata/RHSA-2026:11916
https://access.redhat.com/errata/RHSA-2026:11996
https://access.redhat.com/errata/RHSA-2026:19375
https://access.redhat.com/errata/RHSA-2026:21017
https://access.redhat.com/errata/RHSA-2026:21769

Get alerted when CVE-2026-32286 or the next vulnerability affects your stack