Description
Memory-safety vulnerability in github.com/jackc/pgx/v5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| github.com/jackc/pgx/v5 | github.com/jackc/pgx/v5/pgproto3 | < 5.9.0 | 5.9.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-jackc-pgx-v5 | 5.9.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-jackc-pgx-v5 | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-jackc-pgx-v5 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | go-fdo-server +3 | 1.0.1-1.el10_2 | RHSA-2026:19137 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | go-fdo-server +3 | 1.0.1-0.1.hum1 | RHSA-2026:13907 |
| Red Hat Edge Manager 1 | flightctl +3 | 1.0.3-1.el9em | RHSA-2026:41019, RHSA-2026:36796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | go-fdo-server +3 | 1.0.1-1.el10_2 | ALSA-2026:19137 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | go-fdo-server | 1.0.1-1.el10_2 | RLSA-2026:19137 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kubectl-cnpg | 1.29.1-1.1 | openSUSE-SU-2026:10754-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | go-fdo-server +3 | 1.0.1-2.el10_2 | ELSA-2026-19137 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cloudnative-pg-plugins | 1.29.0-r3 | — |
| Wolfi rolling | envoy-gateway-egctl | 1.7.2-r1 | — |
| Wolfi rolling | gitaly-18.6 +2 | No fix yet | — |
| Wolfi rolling | k3s +1 | 1.35.3.1-r3 | — |
| Wolfi rolling | k3s-1.32 +1 | 1.32.13.1-r12 | — |
| Wolfi rolling | k3s-1.34 +1 | 1.34.6.1-r3 | — |
| Wolfi rolling | k3s-1.35 +1 | 1.35.3.1-r2 | — |
| Wolfi rolling | kine | 0.14.16-r2 | — |
| Wolfi rolling | kots | 1.130.0-r5 | — |
| Wolfi rolling | spire-server | 1.14.5-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/jackc/pgx/v5 | < 5.9.0 | 5.9.0 | GHSA-9jj7-4m8r-rfcm |
Advisories 10
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:19137 Important: go-fdo-server security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:41019 Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:36796 Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19137 Red Hat Security Advisory: go-fdo-server security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:13907 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- ELSA-2026-19137 Important: go-fdo-server security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- RLSA-2026:19137 Important: go-fdo-server security update Rocky Linux Security Advisories · May 29, 2026
- openSUSE-SU-2026:10754-1 kubectl-cnpg-1.29.1-1.1 on GA media SUSE / openSUSE Security Updates · May 13, 2026