Description
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jackc | pgx | < 4.18.2, >= 5.0.0, < 5.5.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-jackc-pgconn | 1.14.3-1 | — |
| Debian 14 | golang-github-jackc-pgx | 4.18.1-2 | — |
| Debian 13 | golang-github-jackc-pgconn | No fix yet | — |
| Debian 13 | golang-github-jackc-pgx | 4.18.1-2 | — |
| Debian 12 | golang-github-jackc-pgx +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-jackc-pgx +1 | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-jackc-pgx +1 | No fix yet | — |
| Ubuntu 25.10 | golang-github-jackc-pgx +1 | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-jackc-pgx +1 | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-jackc-pgx | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | telegraf | 1.31.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | telegraf | 1.28.5-5 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | amass | 4.2.0-r8 | — |
| Wolfi rolling | argo-workflows | 3.5.5-r3 | — |
| Wolfi rolling | caddy | 2.7.6-r4 | — |
| Wolfi rolling | ferretdb | 1.20.1-r3 | — |
| Wolfi rolling | k3s +2 | 1.29.2-r3 | — |
| Wolfi rolling | kine | 0.11.6-r2 | — |
| Wolfi rolling | kots | 1.108.1-r0 | — |
| Wolfi rolling | kube-bench | 0.7.2-r3 | — |
| Wolfi rolling | spicedb | 1.30.0-r0 | — |
| Wolfi rolling | src | 5.3.0-r2 | — |
| Wolfi rolling | step | 0.28.6-r0 | — |
| Wolfi rolling | step-ca | 0.25.2-r5 | — |
| Wolfi rolling | tdbg +9 | 1.23.0-r1 | — |
| Wolfi rolling | trillian | 1.6.0-r2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
roaris/CVE-2024-27304-PoC ★ 1 · Oct 12, 2025
PoC of "DEF CON 32 - SQL Injection Isn't Dead Smuggling Queries at the Protocol Level - Paul Gerste"
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/jackc/pgproto3 | < 2.3.3 | 2.3.3 | GHSA-7jwh-3vrq-q3m8 |
| Go | github.com/jackc/pgproto3/v2 | < 2.3.3 | 2.3.3 | GHSA-7jwh-3vrq-q3m8 |
| Go | github.com/jackc/pgx | < 4.18.2 | 4.18.2 | GHSA-mrww-27vc-gghv |
| Go | github.com/jackc/pgx | >= 5.0.0, < 5.5.4 | 5.5.4 | GHSA-mrww-27vc-gghv |
| Go | github.com/jackc/pgx | all versions | — | GO-2024-2606 |
| Go | github.com/jackc/pgx/v4 | < 4.18.2 | 4.18.2 | GHSA-mrww-27vc-gghv |
| Go | github.com/jackc/pgx/v5 | >= 5.0.0, < 5.5.4 | 5.5.4 | GHSA-mrww-27vc-gghv |
Advisories 1
- WID-SEC-2024-0626 Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Oct 16, 2024
References
- https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv
- https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8
- https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007
- https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4
- https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8
- https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
- https://www.youtube.com/watch?v=Tfg1B8u1yvE