SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx

2024-03-1417:12:43

Google

osv.dev

sql injection

integer overflow

message size

4gb+

software vulnerability

8.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.0%

JSON

An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker’s control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size.

CPENameOperatorVersion
github.com/jackc/pgx/v5ge5.0.0
github.com/jackc/pgx/v4lt4.18.2
github.com/jackc/pgproto3/v2lt2.3.3
github.com/jackc/pgx/v5lt5.5.4