CVE-2026-32286: Denial of service in github.com/jackc/pgproto3/v2
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict which PostgreSQL servers clients may connect to. Use firewall rules, ACLs, or network segmentation to ensure client applications only connect to trusted, internal database hosts and cannot reach untrusted or public PostgreSQL servers.
- Compensating control
Enforce strong server authentication (TLS with strict certificate validation and/or mutual TLS) so clients verify the identity of the PostgreSQL server before accepting DataRow messages from it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32286?
CVE-2026-32286 is classified as a denial of service vulnerability.
How do I fix CVE-2026-32286?
To fix CVE-2026-32286, update the golang/github.com/jackc/pgproto3/v2 package to the latest version that addresses this issue.
What causes CVE-2026-32286?
CVE-2026-32286 is caused by the DataRow.Decode function failing to properly validate negative field lengths from a PostgreSQL server.
Who is affected by CVE-2026-32286?
CVE-2026-32286 affects applications using the golang/github.com/jackc/pgproto3/v2 package that interact with PostgreSQL servers.
Can CVE-2026-32286 allow remote attackers to crash services?
Yes, CVE-2026-32286 can allow remote attackers to cause a service to crash by sending a specially crafted DataRow message.