{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33816", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-03-23T20:35:32.814Z", "datePublished": "2026-04-07T15:19:24.529Z", "dateUpdated": "2026-04-09T14:26:09.200Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-04-07T15:19:24.529Z"}, "title": "CVE-2026-33816 in github.com/jackc/pgx", "descriptions": [{"lang": "en", "value": "Memory-safety vulnerability in github.com/jackc/pgx/v5."}], "affected": [{"vendor": "github.com/jackc/pgx/v5", "product": "github.com/jackc/pgx/v5/pgproto3", "collectionURL": "https://pkg.go.dev", "packageName": "github.com/jackc/pgx/v5/pgproto3", "programRoutines": [{"name": "FunctionCall.Decode"}, {"name": "Backend.Receive"}], "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-697 \u2014 Incorrect Comparison"}]}], "references": [{"url": "https://pkg.go.dev/vuln/GO-2026-4772"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T14:24:50.570972Z", "id": "CVE-2026-33816", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T14:26:09.200Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-33816", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T14:24:50.570972Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T14:26:04.652Z"}}], "cna": {"title": "CVE-2026-33816 in github.com/jackc/pgx", "affected": [{"vendor": "github.com/jackc/pgx/v5", "product": "github.com/jackc/pgx/v5/pgproto3", "packageName": "github.com/jackc/pgx/v5/pgproto3", "collectionURL": "https://pkg.go.dev", "defaultStatus": "affected", "programRoutines": [{"name": "FunctionCall.Decode"}, {"name": "Backend.Receive"}]}], "references": [{"url": "https://pkg.go.dev/vuln/GO-2026-4772"}], "descriptions": [{"lang": "en", "value": "Memory-safety vulnerability in github.com/jackc/pgx/v5."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-697 \u2014 Incorrect Comparison"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-04-07T15:19:24.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33816", "state": "PUBLISHED", "dateUpdated": "2026-04-09T14:26:09.200Z", "dateReserved": "2026-03-23T20:35:32.814Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-04-07T15:19:24.529Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Memory-safety vulnerability in github.com/jackc/pgx/v5."}], "id": "CVE-2026-33816", "lastModified": "2026-04-09T15:16:10.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-07T16:16:24.920", "references": [{"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-4772"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "github.com/jackc/pgx/v5/pgproto3: github.com/jackc/pgx: Memory-safety vulnerability", "id": "2455972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455972"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in github.com/jackc/pgx, a PostgreSQL driver for Go. This memory-safety vulnerability could allow an attacker to cause various impacts, such as denial of service (DoS) or potentially arbitrary code execution, by exploiting memory corruption issues. The exact method of exploitation and specific consequences would depend on the nature of the memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-33816", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/custom-metrics-autoscaler-operator", "product_name": "Custom Metric Autoscaler operator for Red Hat Openshift"}, {"cpe": "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/keda-adapter", "product_name": "Custom Metric Autoscaler operator for Red Hat Openshift"}, {"cpe": "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/keda-operator", "product_name": "Custom Metric Autoscaler operator for Red Hat Openshift"}, {"cpe": "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/keda-webhooks", "product_name": "Custom Metric Autoscaler operator for Red Hat Openshift"}, {"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "redhat-user-workloads/azure-service-operator-mce-211", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-agent-rhel8", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-agent-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-manager-rhel8", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-manager-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-operator-bundle", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-rhel8-operator", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "multicluster-globalhub/multicluster-globalhub-rhel9-operator", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/glo-grafana-globalhub-1-7", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-4", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-5", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-6", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-7", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-4", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-5", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-6", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-7", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-4", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-5", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-6", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Affected", "package_name": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-7", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/3scale-operator-bundle", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Will not fix", "package_name": "3scale-amp2/3scale-rhel7-operator", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-amp2/3scale-rhel9-operator", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/grafana-acm-214", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/grafana-acm-215", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "redhat-user-workloads/grafana-acm-216", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Affected", "package_name": "rhacs-eng/release-main", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Not affected", "package_name": "rhacs-eng/release-operator", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Affected", "package_name": "rhacs-eng/release-roxctl", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:4", "fix_state": "Affected", "package_name": "rhacs-eng/release-scanner-v4", "product_name": "Red Hat Advanced Cluster Security 4"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "flightctl", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-alert-exporter", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-alertmanager-proxy", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-api", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-cli-artifacts", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-db-setup", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-pam-issuer", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-periodic", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-telemetry-gateway", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-userinfo-proxy", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/a:redhat:edge_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/flightctl-worker", "product_name": "Red Hat Edge Manager 1"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "go-fdo-server", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-maas-api-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-ml-pipelines-api-server-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-ml-pipelines-driver-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-ml-pipelines-launcher-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-model-registry-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "package_name": "rhceph-dev/odf4-odf-cloudnative-pg-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "redhat-user-workloads/quay-clair-v3-17", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Affected", "package_name": "securesign/certificate-transparency-go", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Affected", "package_name": "securesign/trillian-createtree", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Affected", "package_name": "securesign/trillian-database", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Affected", "package_name": "securesign/trillian-logserver", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Affected", "package_name": "securesign/trillian-logsigner", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:trusted_artifact_signer:1", "fix_state": "Affected", "package_name": "securesign/trillian-updatetree", "product_name": "Red Hat Trusted Artifact Signer"}, {"cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/spiffe-spire-agent-1-13-3", "product_name": "Zero Trust Workload Identity Manager"}, {"cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/spiffe-spire-oidc-discovery-provider-1-13-3", "product_name": "Zero Trust Workload Identity Manager"}, {"cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:1", "fix_state": "Affected", "package_name": "redhat-user-workloads/spiffe-spire-server-1-13-3", "product_name": "Zero Trust Workload Identity Manager"}, {"cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:0", "fix_state": "Affected", "package_name": "redhat-user-workloads/spiffe-spire-agent-1-12-4", "product_name": "Zero Trust Workload Identity Manager - Tech Preview"}, {"cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:0", "fix_state": "Affected", "package_name": "redhat-user-workloads/spiffe-spire-oidc-discovery-provider-1-12-4", "product_name": "Zero Trust Workload Identity Manager - Tech Preview"}, {"cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:0", "fix_state": "Affected", "package_name": "redhat-user-workloads/spiffe-spire-server-1-12-4", "product_name": "Zero Trust Workload Identity Manager - Tech Preview"}], "public_date": "2026-04-07T15:19:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33816\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33816\nhttps://pkg.go.dev/vuln/GO-2026-4772"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "github.com/jackc/pgx/v5/pgproto3", "source": "cna", "vendor": "github.com/jackc/pgx/v5"}, "product": "pgx", "vendor": "jackc"}], "analysis": {"en": {"generated_at": "2026-04-08T13:52:20.381874+00:00", "value": {"mitigation_remediation": ["Apply the latest patched release of the pgx v5 module from the GitHub repository.", "If a patched release is not yet available, restrict external access to the database driver or limit untrusted input to reduce exposure.", "Monitor the project\u2019s security advisories and Go module vulnerability database for a fix.", "Perform regular dependency scans and code reviews to detect new third\u2011party library vulnerabilities."], "summary": {"action": "Immediate Patch", "impact": "Memory corruption that could lead to remote code execution"}, "threat_synthesis": {"affected_systems": "The affected packages are the GitHub repository jackc/pgx v5 and its subpackage pgproto3. Any Go application that imports and uses these modules without the patch is vulnerable. No specific version ranges are given, so all releases of these packages are considered affected until updated.", "description_and_impact": "The vulnerability is a memory\u2011safety flaw in the Go PostgreSQL driver pgx v5. It is an out\u2011of\u2011bounds write (CWE\u2011787) that can corrupt adjacent memory and potentially allow an attacker to hijack program execution. The description indicates a serious risk to application integrity and confidentiality. The driver could be fed malformed data by an external source, leading to arbitrary code execution or other unintended behavior.", "risk_and_exploitability": "The CVSS score of 8.3 classifies this vulnerability as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating no confirmed public exploits yet. Likely attack vectors involve sending crafted inputs to the PostgreSQL driver over a network; the flaw is inferred to be exploitable remotely as the driver often processes data from untrusted clients. Overall, the risk is substantial due to the potential for remote code execution and the lack of immediate public exploitation evidence."}}}}, "created": "2026-04-08T19:37:06.441122+00:00", "title": "Out-of-bounds write in Go PostgreSQL driver leads to memory corruption", "updated": "2026-04-08T19:48:17.698578+00:00", "vendors": ["jackc", "jackc$PRODUCT$pgx"]}