DemoBook a demo

Vulnerability advisory

CVE-2026-32286

Denial of service in github.com/jackc/pgproto3/v2

Published Updated OSV record ↗

Also known as GHSA-jqcq-xjh3-6g23GO-2026-4518

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/jackc/pgproto3 ↗
eca1e51822f3ebd8f48f62029d3e32f931d32c32 through 945c2126f6db8f3bea7eeebe307c01fe92bca007No fix listed
Also listed as affected (15)
  • v2.3.3
  • v2.3.2
  • v2.3.1
  • v2.3.0
  • v2.2.0
  • v2.1.1
  • v2.1.0
  • v2.0.7
  • v2.0.6
  • v2.0.5
  • v2.0.4
  • v2.0.3
  • v2.0.2
  • v2.0.1
  • v2.0.0

Description

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.