GO-2026-6172 WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq

This report has been withdrawn with reason: "False positive". github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active network attacker on an unauthenticated connection ca...

GO-2026-6173 WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq

This report has been withdrawn with reason: "False positive". The special-case parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls bufio.Reader.ReadString0 without a byte limit. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport...

GO-2026-6166 WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq

This report has been withdrawn with reason: "False positive". github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS tok...

GO-2026-6170 WITHDRAWN: Malformed backend frame length causes panic in github.com/lib/pq

This report has been withdrawn with reason: "False positive". github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose length is zero through three produces a negati...

GO-2026-6168 WITHDRAWN: Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram

This report has been withdrawn with reason: "False positive". The SCRAM client in github.com/lib/pq/scram accepts an attacker-controlled iteration count with no upper bound and immediately performs that many PBKDF2-style HMAC rounds. A PostgreSQL endpoint or active network attacker can send a val...

GO-2026-6169 WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq

This report has been withdrawn with reason: "False positive". When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost an...

GO-2026-6171 WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq

This report has been withdrawn with reason: "False positive". github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A malicious PostgreSQL endpoint or active network...