CVE-2026-32286

Description

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

PUBLISHED Reserved 2026-03-11 | Published 2026-03-26 | Updated 2026-04-02 | Assigner Go

Problem types

CWE-125: Out-of-bounds Read

Product status

References

securityinfinity.com/...l-wire-protocol-parsers-pgproto3-pgx exploit

github.com/advisories/GHSA-jqcq-xjh3-6g23

github.com/jackc/pgx/issues/2507

github.com/golang/vulndb/issues/4518

pkg.go.dev/vuln/GO-2026-4518

cve.org (CVE-2026-32286)

nvd.nist.gov (CVE-2026-32286)

Download JSON