# CVE-2026-56869: GO-2026-6168 - WITHDRAWN: Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram

Source: https://junglewise.ai/threats/cve-2026-56869-go-2026-6168-withdrawn-unbounded-iteration-count-causes-cpu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18  
License: CC BY 4.0 with a link back

CVE-2026-56869 · Severity: info · Published 2026-08-18

WITHDRAWN: Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram

Technologies: [github.com/lib/pq (Go)](https://junglewise.ai/threats/technologies/github-com-lib-pq). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-56869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56869 being exploited in the wild.

**How severe is CVE-2026-56869?** Informational severity, published 18 August 2026.

**Which products and versions are affected?** github.com/lib/pq (Go) SEMVER:introduced=1.1.0.

**Is there a fix for CVE-2026-56869?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-56869?** Check whether you run github.com/lib/pq (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- github.com/lib/pq (Go) SEMVER:introduced=1.1.0

## Identifiers

- CVE-2026-56869
- GO-2026-6168

## Related threats

- [GO-2026-6166 - WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56868-go-2026-6166-withdrawn-gss-authentication-completes-without)
- [GO-2026-6171 - WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56872-go-2026-6171-withdrawn-malformed-rowdescription-and-datarow)
- [GO-2026-6169 - WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56870-go-2026-6169-withdrawn-disclosure-of-wrong-pgpass-credential-via)
- [GO-2026-6173 - WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56874-go-2026-6173-withdrawn-pre-protocol-error-reader-permits)
- [GO-2026-6170 - WITHDRAWN: Malformed backend frame length causes panic in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56871-go-2026-6170-withdrawn-malformed-backend-frame-length-causes)