CVE-2024-27304High· 8.1▾ MidnightPoC availablepgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
1.1%
Last analysed / modified upstream
9.8 → 8.1
critical → high
1 GitHub repo (last check)
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
pgx: SQL Injection via Protocol Message Size Overflow — rated Moderate by Red Hat. Released 2024-03-06, updated 2026-09-19.
Affected:
Fixed:
No fix planned:
Not affected:
If you are using an earlier version of RHACS 4.3, you are advised to upgrade to patch release 4.3.5. https://access.redhat.com/errata/RHSA-2024:1321
Affected packages:
github.com/jackc/pgproto3 < 2.3.3github.com/jackc/pgproto3/v2 < 2.3.3Patched in:
github.com/jackc/pgproto3 2.3.3github.com/jackc/pgproto3/v2 2.3.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91203Medium· 6.0A flaw was found in cockpit-files
CVE-2026-92747Medium· 5.0A flaw was found in `cockpit-machines`
CVE-2026-93558High· 7.5A flaw was found in Netty's WebSocketServerExtensionHandler
CVE-2026-93578Medium· 5.9A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client
CVE-2026-81627High· 8.2A flaw was found in QEMU
CVE-2026-89059High· 7.5A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count