Vulnerability advisory

GHSA-7jwh-3vrq-q3m8

pgproto3 SQL Injection via Protocol Message Size Overflow

Published Mar 4, 2024Updated Sep 10, 2026OSV record ↗

Also known as CVE-2024-27304GHSA-mrww-27vc-gghvGO-2024-2606

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Affected versions

github.com/jackc/pgproto3 Go

All github.com/jackc/pgproto3 advisories →

Affected	Fixed in
All versions before 2.3.3	`2.3.3`

github.com/jackc/pgproto3/v2 Go

All github.com/jackc/pgproto3/v2 advisories →

Affected	Fixed in
All versions before 2.3.3	`2.3.3`

Description

Impact

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Patches

The problem is resolved in v2.3.3

Workarounds

Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.