Skip to content
OpenAdvisories

Package · Go

github.com/jackc/pgx

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 2.3
    CVE-2026-41889

    pgx: SQL Injection via placeholder confusion with dollar quoted string literals

    pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be inte…

    jackc pgx github.com/jackc/pgx/v5 golang-github-jackc-pgx-v5 Debian Ubuntu Go
  • Critical 9.8
    CVE-2024-27304 Public exploit

    pgx SQL Injection via Protocol Message Size Overflow

    pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple me…

    jackc pgx github.com/jackc/pgx/v5 github.com/jackc/pgx/v4 Debian Ubuntu Go
  • High 8.1
    CVE-2024-27289

    pgx SQL Injection via Line Comment Creation

    pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; t…

    jackc pgx github.com/jackc/pgx/v4 github.com/jackc/pgx Debian Ubuntu Go