TI-2026-24815 Aliases CVE-2026-32286 GHSA-jqcq-xjh3-6g23

Denial of service in github.com/jackc/pgproto3/v2

HIGH 72CWE-129Published 2026-03-26 · Updated 2026-09-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 15 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00675 52nd percentileScored 2026-11-07

Fix Partial Red Hat: 16 advisoriesRed Hat: 15 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	github.com/jackc/pgproto3/v2 (Go)	2.0.0 – 2.3.3	—	No fix listed	GHSA-jqcq-xjh3-6g23

github.com/jackc/pgproto3/v2 (Go) Vendor— Affected 2.0.0 – 2.3.3 Fixed in — No fix listed GHSA-jqcq-xjh3-6g23

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jackc:pgproto3::::::go::*	2.0.0 – 2.3.3	Vulnerable	jackc

cpe:2.3:a:jackc:pgproto3:*:*:*:*:*:go:*:* Versions 2.0.0 – 2.3.3 Vulnerable ·jackc

Remediation

Red Hat 16 advisories

RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
RHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
RHSA-2026:24853 Released 2026-06-09 · Red Hat rating Important
Red Hat Quay 3.15.5
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
RHSA-2026:23345 Released 2026-06-04 · Red Hat rating Important
Multicluster Global Hub 1.6.2 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1

Show 13 more Red Hat advisories

RHSA-2026:22714 Released 2026-06-03 · Red Hat rating Important
osbuild-composer security update
- Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-165.1-2.el9_8, osbuild-composer-core-165.1-2.el9_8, osbuild-composer-worker-165.1-2.el9_8
RHSA-2026:22465 Released 2026-06-02 · Red Hat rating Important
Red Hat Quay 3.17.2
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
RHSA-2026:22450 Released 2026-06-02 · Red Hat rating Important
osbuild-composer security update
- Red Hat Enterprise Linux AppStream (v. 10) osbuild-composer-165.1-2.el10_2, osbuild-composer-core-165.1-2.el10_2, osbuild-composer-worker-165.1-2.el10_2
RHSA-2026:22423 Released 2026-06-02 · Red Hat rating Important
Multicluster Global Hub 1.3.4 security update
- Multicluster Global Hub 1.3.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
RHSA-2026:22347 Released 2026-06-01 · Red Hat rating Important
Multicluster Global Hub 1.4.5 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
RHSA-2026:21769 Released 2026-05-28 · Red Hat rating Important
Multicluster Global Hub 1.5.4 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
RHSA-2026:21017 Released 2026-05-26 · Red Hat rating Important
Red Hat Quay 3.14.8
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
RHSA-2026:19375 Released 2026-05-19 · Red Hat rating Important
Red Hat Quay 3.16.4
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
RHSA-2026:11996 Released 2026-04-30 · Red Hat rating Important
Red Hat Quay 3.9.21
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
RHSA-2026:11916 Released 2026-04-29 · Red Hat rating Important
Red Hat Quay 3.10.21
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
RHSA-2026:11856 Released 2026-04-29 · Red Hat rating Important
Red Hat Quay 3.12.17
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
RHSA-2026:11217 Released 2026-04-27 · Red Hat rating Important
RHACS 4.8.11 security and bug fix update
- Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2
RHSA-2026:11070 Released 2026-04-27 · Red Hat rating Important
RHACS 4.8.11 security and bug fix update
- Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2	Affected	No fix yet
Multicluster Engine for Kubernetes	Affected	No fix yet
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix planned: Will not fix
Red Hat OpenShift Cluster Manager CLI	Affected	No fix yet
Red Hat OpenShift on AWS	Affected	No fix yet
Red Hat Quay 3	Affected	No fix yet
Multicluster Global Hub 1.3.4	Fixed	RHSA-2026:22423
Multicluster Global Hub 1.4.9	Fixed	RHSA-2026:22347
Multicluster Global Hub 1.5.8	Fixed	RHSA-2026:21769
Multicluster Global Hub 1.6.6	Fixed	RHSA-2026:23345
Red Hat Advanced Cluster Security 4.8	Fixed	RHSA-2026:11070, RHSA-2026:11217
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2026:22450
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:22714
Red Hat OpenShift AI 3.3	Fixed	RHSA-2026:73987
Red Hat Quay 3.10	Fixed	RHSA-2026:11916
Red Hat Quay 3.12	Fixed	RHSA-2026:11856
Red Hat Quay 3.14	Fixed	RHSA-2026:21017
Red Hat Quay 3.15	Fixed	RHSA-2026:24853
Red Hat Quay 3.16	Fixed	RHSA-2026:19375
Red Hat Quay 3.17	Fixed	RHSA-2026:22465
Red Hat Quay 3.9	Fixed	RHSA-2026:11996

Not affected: 20 products

Multicluster Global Hub
Multicluster Global Hub 1.3.4
Multicluster Global Hub 1.4.9
Multicluster Global Hub 1.5.8
Multicluster Global Hub 1.6.6
Red Hat Advanced Cluster Security 4
Red Hat Advanced Cluster Security 4.8
Red Hat Hardened Images
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift AI 3.3
Red Hat OpenShift Container Platform 4
Red Hat Quay 3
Red Hat Quay 3.10
Red Hat Quay 3.12
Red Hat Quay 3.14
Red Hat Quay 3.15
Red Hat Quay 3.16
Red Hat Quay 3.17
Red Hat Quay 3.9
Red Hat Trusted Artifact Signer

Timeline

2026-10-02 Threatist record created from CVE-2026-32286
2026-10-03 Alias added: GHSA-jqcq-xjh3-6g23
2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
2026-10-16 EPSS moved to the 50th–90th percentile

References

Patch 1

https://pkg.go.dev/vuln/GO-2026-4518

Advisory 3

Other 4

TI-2024-18142 pgx SQL Injection via Protocol Message Size Overflow CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences