Vulnerability DatabaseCVE-2026-32286
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-32286
March 26, 2026
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Related Resources (7)
https://github.com/golang/vulndb/issues/4518
https://github.com/jackc/pgx/issues/2507
https://github.com/jackc/pgproto3
https://bugzilla.redhat.com/show_bug.cgi?id=2448626
https://nvd.nist.gov/vuln/detail/CVE-2026-32286
https://pkg.go.dev/vuln/GO-2026-4518
https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx
Do you need more information?
Contact Us
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Weakness Type (CWE)
Improper Validation of Array Index
CWE-129
EPSS
Base Score:
0.02