The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 26 Mar 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic. | |
| Title | Denial of service in github.com/jackc/pgproto3/v2 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2026-03-26T19:40:51.974Z
Reserved: 2026-03-11T16:38:46.556Z
Link: CVE-2026-32286
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-26T20:16:12.303
Modified: 2026-03-26T20:16:12.303
Link: CVE-2026-32286
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.