# CVE-2026-56873: GO-2026-6172 - WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq

Source: https://junglewise.ai/threats/cve-2026-56873-go-2026-6172-withdrawn-backend-frame-lengths-cause-pre-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18  
License: CC BY 4.0 with a link back

CVE-2026-56873 · Severity: info · Published 2026-08-18

WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq

Technologies: [github.com/lib/pq (Go)](https://junglewise.ai/threats/technologies/github-com-lib-pq). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-56873 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56873 being exploited in the wild.

**How severe is CVE-2026-56873?** Informational severity, published 18 August 2026.

**Which products and versions are affected?** github.com/lib/pq (Go) SEMVER:introduced=1.0.0.

**Is there a fix for CVE-2026-56873?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-56873?** Check whether you run github.com/lib/pq (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- github.com/lib/pq (Go) SEMVER:introduced=1.0.0

## Identifiers

- CVE-2026-56873
- GO-2026-6172

## Related threats

- [GO-2026-6166 - WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56868-go-2026-6166-withdrawn-gss-authentication-completes-without)
- [GO-2026-6168 - WITHDRAWN: Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram](https://junglewise.ai/threats/cve-2026-56869-go-2026-6168-withdrawn-unbounded-iteration-count-causes-cpu)
- [GO-2026-6171 - WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56872-go-2026-6171-withdrawn-malformed-rowdescription-and-datarow)
- [GO-2026-6169 - WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56870-go-2026-6169-withdrawn-disclosure-of-wrong-pgpass-credential-via)
- [GO-2026-6173 - WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq](https://junglewise.ai/threats/cve-2026-56874-go-2026-6173-withdrawn-pre-protocol-error-reader-permits)