Vulnerability advisory
GO-2026-4518
Denial of service in github.com/jackc/pgproto3/v2
Also known as CVE-2026-32286GHSA-jqcq-xjh3-6g23
Severity
Severity not reported.
Affected versions
| Affected | Fixed in |
|---|---|
2.0.0 and later | No fix listed |
Description
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.