Executive brief
A vulnerability exists in a Go library used to communicate with PostgreSQL databases. A malicious or compromised database server can send a specially crafted message that causes the application using this library to crash immediately. This results in a denial-of-service, potentially disrupting business operations and application availability.
Technical details
The vulnerability exists in the DataRow.Decode function of the github.com/jackc/pgproto3/v2 package. The function reads a field length as a signed 32-bit integer but fails to check for negative values other than the -1 null sentinel. Because Go's len() function always returns a non-negative value, a comparison check (len(src[rp:]) < msgSize) is bypassed when msgSize is negative. This leads to a 'slice bounds out of range' panic when the code attempts to slice the buffer using the negative index. An attacker controlling a PostgreSQL server can exploit this to cause a remote denial-of-service (DoS) against any Go client application using this library.
Affected products
- jackc pgproto3/v2 >= 2.0.0, <= 2.3.3
Timeline
- 2026-02-19: disclosed: Issue reported on GitHub and Go vulnerability database
- 2026-03-18: advisory: GitHub Advisory GHSA-jqcq-xjh3-6g23 published
- 2026-03-26: advisory: NVD published CVE-2026-32286