pgx SQL Injection via Protocol Message Size Overflow
Priority MEDIUM 50CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190, CWE-89 and the CVSS impact.
Summary
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01109 66th percentileScored 2026-11-07
Fix Partial pgx (jackc): 4.18.2, 5.5.4github.com/jackc/pgx (Go): 4.18.2, 5.5.4+2 more productsRed Hat: 1 advisoryRed Hat: 1 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jackc | pgx | before 4.18.2; 5.0.0 to before 5.5.4 | 4.18.2, 5.5.4 | Patch available | CNA |
| — | github.com/jackc/pgx (Go) | before 4.18.2 | 4.18.2 | Patch available | GHSA-mrww-27vc-gghv |
| — | github.com/jackc/pgx (Go) | 5.0.0 to before 5.5.4 | 5.5.4 | Patch available | GHSA-mrww-27vc-gghv |
| — | github.com/jackc/pgx/v4 (Go) | before 4.18.2 | 4.18.2 | Patch available | GHSA-mrww-27vc-gghv |
| — | github.com/jackc/pgx/v5 (Go) | 5.0.0 to before 5.5.4 | 5.5.4 | Patch available | GHSA-mrww-27vc-gghv |
- pgx Vendorjackc Affected before 4.18.2; 5.0.0 to before 5.5.4 Fixed in 4.18.2, 5.5.4 Patch available CNA
- github.com/jackc/pgx (Go) Vendor— Affected before 4.18.2 Fixed in 4.18.2 Patch available GHSA-mrww-27vc-gghv
- github.com/jackc/pgx (Go) Vendor— Affected 5.0.0 to before 5.5.4 Fixed in 5.5.4 Patch available GHSA-mrww-27vc-gghv
- github.com/jackc/pgx/v4 (Go) Vendor— Affected before 4.18.2 Fixed in 4.18.2 Patch available GHSA-mrww-27vc-gghv
- github.com/jackc/pgx/v5 (Go) Vendor— Affected 5.0.0 to before 5.5.4 Fixed in 5.5.4 Patch available GHSA-mrww-27vc-gghv
Remediation
- Fix · CNA pgx (jackc) Fixed in 4.18.2, 5.5.4
- Fix · GHSA-mrww-27vc-gghv github.com/jackc/pgx (Go) Fixed in 4.18.2 Advisory →
- Fix · GHSA-mrww-27vc-gghv github.com/jackc/pgx (Go) Fixed in 5.5.4 Advisory →
- Fix · GHSA-mrww-27vc-gghv github.com/jackc/pgx/v4 (Go) Fixed in 4.18.2 Advisory →
- Fix · GHSA-mrww-27vc-gghv github.com/jackc/pgx/v5 (Go) Fixed in 5.5.4 Advisory →
Red Hat 1 advisory
- RHSA-2024:1321 Released 2024-03-13 · Red Hat rating ModerateACS 4.3 enhancement and security update
- RHACS 4.3 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| RHACS 4.3 for RHEL 8 | Fixed | RHSA-2024:1321 |
Not affected: 3 products
- Multicluster Engine for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Openshift Data Foundation 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27304
- 2026-10-03 Alias added: GHSA-mrww-27vc-gghv
References
Patch 4
- https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007
- https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4
- https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8
- https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
Advisory 3
More jackc Pgproto3 vulnerabilities
- TI-2026-24815 Denial of service in github.com/jackc/pgproto3/v2 CVSS 3.1HIGH 7.5
Sources
- CVE-2024-27304 · CVE Program
- CVE-2024-27304 · NVD
- FIRST EPSS
- GHSA-mrww-27vc-gghv · GitHub Advisory Database · CC BY 4.0
- CVE-2024-27304 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences