CVE-2026-32286 — Denial of service in github.com/jackc/pgproto3/v2
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causi…
Published: 2026-03-26 · CVSS: 7.5 · CVSS 3.1
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7