← CVE Intelligence

CVE-2026-32286

Denial of service in github.com/jackc/pgproto3/v2 PUBLISHED

Description (CNA)

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

Affected (CNA)

Vendor / productVersions
github.com/jackc/pgproto3/v2 / github.com/jackc/pgproto3/v2unaffected 0 before 2.0.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

redhat-SADP

A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.