{"id":"CVE-2026-32286","title":"The DataRow.Decode function fails to properly validate field lengths","summary":"The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-129","CWE-1285","CWE-125"],"vendor":"jackc","product":"pgproto3","affected":["pgproto3 >= 2.0.0, <= 2.3.3"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","multicluster_global_hub 1.3.4","multicluster_global_hub 1.4.5","multicluster_global_hub 1.6.5","advanced_cluster_security 4.8","quay 3.12","quay 3.14","quay 3.15","quay 3.16","quay 3.17","quay 3.1","quay 3.9","multicluster_global_hub 1.5.3"],"published":"2026-03-26","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:18:08.907","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32286","references":[{"url":"https://github.com/advisories/GHSA-jqcq-xjh3-6g23","label":"security@golang.org"},{"url":"https://github.com/golang/vulndb/issues/4518","label":"security@golang.org"},{"url":"https://github.com/jackc/pgx/issues/2507","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-4518","label":"security@golang.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:11070","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:11217","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:11856","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:11916","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:11996","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22450","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22714","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32286","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451847","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32286.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32286"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32286"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-30T14:08:15.986882Z"},"epss":0.0065,"epssPercentile":0.49392,"exploits":{"github":2,"githubRepos":["https://github.com/moisei-dev/go-dbmigrate","https://github.com/slashid/baton-retool"],"checkedAt":"2026-09-21T15:28:40.943Z"},"ingestedAt":"2026-07-01T15:50:58.741Z","slug":"CVE-2026-32286","body":"## Overview\n\nThe DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.\n\n## Affected\n\n- `pgproto3 >= 2.0.0, <= 2.3.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:22450** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22450)\n- **RHSA-2026:22714** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22714)\n- **RHSA-2026:22423** · Red Hat · fixed in: Multicluster Global Hub 1.3.4 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22423)\n- **RHSA-2026:22347** · Red Hat · fixed in: Multicluster Global Hub 1.4.5 · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22347)\n- **RHSA-2026:23345** · Red Hat · fixed in: Multicluster Global Hub 1.6.5 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23345)\n- **RHSA-2026:11070** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.8 · released 2026-04-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:11070)\n- **RHSA-2026:11217** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.8 · released 2026-04-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:11217)\n- **RHSA-2026:11856** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-04-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:11856)\n- **RHSA-2026:21017** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:21017)\n- **RHSA-2026:24853** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24853)\n- **RHSA-2026:19375** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19375)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Cluster Manager CLI, … · no fix planned: Red Hat Enterprise Linux 8, Red Hat Quay 3, Assisted Installer for Red Hat OpenShift Container Platform 2, Multicluster Engine for Kubernetes, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32286.json)\n- **RHSA-2026:11916** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-04-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:11916)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5086,"id":"CVE-2026-32286","ts":1788887248028,"field":"exploit_available","old":"false","new":"true"},{"seq":3969,"id":"CVE-2026-32286","ts":1788886363669,"field":"exploit_available","old":"true","new":"false"},{"seq":2786,"id":"CVE-2026-32286","ts":1788883030371,"field":"exploit_available","old":"false","new":"true"},{"seq":1815,"id":"CVE-2026-32286","ts":1788882433287,"field":"exploit_available","old":"true","new":"false"},{"seq":919,"id":"CVE-2026-32286","ts":1788881867033,"field":"exploit_available","old":"false","new":"true"}]}