Vulnerability advisory

GO-2024-2606

SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx

Published Mar 14, 2024Updated Feb 4, 2026OSV record ↗

Also known as CVE-2024-27304GHSA-7jwh-3vrq-q3m8GHSA-mrww-27vc-gghv

Severity

Severity not reported.

Affected versions

github.com/jackc/pgproto3/v2 Go

All github.com/jackc/pgproto3/v2 advisories →

Affected	Fixed in
All versions before 2.3.3	`2.3.3`

github.com/jackc/pgx Go

All github.com/jackc/pgx advisories →

Affected	Fixed in
All versions	No fix listed

github.com/jackc/pgx/v4 Go

All github.com/jackc/pgx/v4 advisories →

Affected	Fixed in
All versions before 4.18.2	`4.18.2`

github.com/jackc/pgx/v5 Go

All github.com/jackc/pgx/v5 advisories →

Affected	Fixed in
`5.0.0` to before 5.5.4	`5.5.4`

Description

An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size.