CVE Feed

    Dashboard / CVE / CVE-2026-32286

    CVE-2026-32286

    The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

    Published:Mar 26, 2026
    Last Modified:Jun 3, 2026
    EPS:Mar 26, 2026
    EPSS Score:0.00067
    CVSS Score:7.5

    Affected Products

    Vendor
    Jackc
    Product
    Pgproto3

    Exploits

    https://github.com/moisei-dev/go-dbmigratehttps://github.com/slashid/baton-retool

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-100 Overflow Buffers

    References

    https://github.com/advisories/GHSA-jqcq-xjh3-6g23
    https://github.com/golang/vulndb/issues/4518
    https://github.com/jackc/pgx/issues/2507
    https://pkg.go.dev/vuln/GO-2026-4518
    https://access.redhat.com/errata/RHSA-2026:11070
    https://access.redhat.com/errata/RHSA-2026:11217
    https://access.redhat.com/errata/RHSA-2026:11856
    https://access.redhat.com/errata/RHSA-2026:11916
    https://access.redhat.com/errata/RHSA-2026:11996
    https://access.redhat.com/errata/RHSA-2026:19375
    https://access.redhat.com/errata/RHSA-2026:21017
    https://access.redhat.com/errata/RHSA-2026:21769
    https://access.redhat.com/errata/RHSA-2026:22347
    https://access.redhat.com/errata/RHSA-2026:22423
    https://access.redhat.com/errata/RHSA-2026:22450
    https://access.redhat.com/errata/RHSA-2026:22465
    https://access.redhat.com/errata/RHSA-2026:22714
    https://access.redhat.com/errata/RHSA-2026:23345
    https://access.redhat.com/errata/RHSA-2026:24853
    https://access.redhat.com/security/cve/CVE-2026-32286
    https://bugzilla.redhat.com/show_bug.cgi?id=2451847
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32286.json
    https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High