CVE-2024-27289

CVE-2024-27289 affects the Go pgx PostgreSQL driver. Before 4.18.2, a SQL injection can occur when using the non-default simple protocol with a minus immediately before a numeric placeholder and a second placeholder for a string on the same line, with both values user-controlled. The issue is fix...

CVE-2024-27304

CVE-2024-27304 affects pgx, a PostgreSQL driver/toolkit for Go. The vulnerability enables SQL injection when an attacker can cause a single query or Bind message to exceed 4 GB due to an integer overflow in message size calculation, which can cause the large message to be split into multiple mess...

CVE-2026-33815

A memory-safety vulnerability exists in the github.com/jackc/pgx/v5 library, specifically identified as an Out-of-bounds Write (CWE-787). This vulnerability affects several products, including IBM Optim (versions 1.0.0, 1.1.0, and 1.2.0), IBM Verify Antenna (versions 25.05.0 - 26.03.0), and IBM S...

CVE-2026-33816

A memory-safety vulnerability exists in the github.com/jackc/pgx/v5 component, characterized as an Out-of-bounds Write (CWE-787). This vulnerability affects multiple products, including IBM Optim for z/OS (versions 1.0.0, 1.1.0, and 1.2.0), argo-workflows , cloudnative-pg , keda , spire-server , ...

CVE-2026-41889

CVE-2026-41889 affects the pgx PostgreSQL driver for Go. Before version 5.9.2, using the non-default simple protocol with a dollar-quoted string containing text that can be interpreted as a placeholder outside of a string literal allows SQL injection when the placeholder value is attacker-control...