Update module github.com/jackc/pgx/v5 to v5.9.2 [SECURITY] - #361

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33816
• https://pkg.go.dev/vuln/GO-2026-4772
• https://github.com/advisories/GHSA-9jj7-4m8r-rfcm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

SQL Injection can occur when:

1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

Patches

The problem is resolved in v5.9.2.

Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx/releases/tag/v5.9.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-41889
• https://github.com/advisories/GHSA-j88v-2chj-qfwx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

pgx is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33815
• https://pkg.go.dev/vuln/GO-2026-4771
• https://github.com/jackc/pgx/issues/2519
• https://github.com/jackc/pgx/issues/2530
• https://github.com/jackc/pgx/commit/6dbad4cafdb8a4daab7ff79c858c95da4b6109e8
• https://github.com/advisories/GHSA-xgrm-4fwx-7qm8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33816
• https://github.com/jackc/pgx
• https://pkg.go.dev/vuln/GO-2026-4772

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Details

pgx is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33815
• https://github.com/jackc/pgx/issues/2519
• https://github.com/jackc/pgx/issues/2530
• https://github.com/jackc/pgx/commit/6dbad4cafdb8a4daab7ff79c858c95da4b6109e8
• https://pkg.go.dev/vuln/GO-2026-4771
• github.com/jackc/pgx/v5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

Unknown

References

No references.

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

Unknown

References

No references.

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

Impact

SQL Injection can occur when:

1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

Patches

The problem is resolved in v5.9.2.

Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://nvd.nist.gov/vuln/detail/CVE-2026-41889
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx
• https://github.com/jackc/pgx/releases/tag/v5.9.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Details

SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible.

For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario.

Severity

Unknown

References

• https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
• https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
• https://github.com/jackc/pgx/releases/tag/v5.9.2

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

v5.9.2

Compare Source

v5.9.1

Compare Source

v5.9.0

Compare Source

v5.8.0

Compare Source

v5.7.6

Compare Source

v5.7.5

Compare Source

v5.7.4

Compare Source

v5.7.3

Compare Source

v5.7.2

Compare Source

v5.7.1

Compare Source

v5.7.0

Compare Source