Read the docs
TI-2026-26187 Aliases CVE-2026-33815GHSA-xgrm-4fwx-7qm8

CVE-2026-33815 in github.com/jackc/pgx

Priority MEDIUM 50Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 16 fixed, 13 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00629 50th percentileScored 2026-11-07
Fix Partial github.com/jackc/pgx/v5/pgproto3 (github.com/jackc/pgx/v5): 5.9.0github.com/jackc/pgx/v5 (Go): 5.9.0Red Hat: 19 advisoriesRed Hat: 16 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
github.com/jackc/pgx/v5github.com/jackc/pgx/v5/pgproto3before 5.9.05.9.0Patch availableCNA
—github.com/jackc/pgx/v5 (Go)before 5.9.05.9.0Patch availableGHSA-xgrm-4fwx-7qm8
  • github.com/jackc/pgx/v5/pgproto3 Vendorgithub.com/jackc/pgx/v5 Affected before 5.9.0 Fixed in 5.9.0 Patch available CNA
  • github.com/jackc/pgx/v5 (Go) Vendor— Affected before 5.9.0 Fixed in 5.9.0 Patch available GHSA-xgrm-4fwx-7qm8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jackc:pgx:*:*:*:*:*:go:*:*all versionsVulnerablejackc
  • cpe:2.3:a:jackc:pgx:*:*:*:*:*:go:*:* Versions all versions Vulnerable ·jackc

Remediation

  • Fix · CNA github.com/jackc/pgx/v5/pgproto3 (github.com/jackc/pgx/v5) Fixed in 5.9.0
  • Fix · GHSA-xgrm-4fwx-7qm8 github.com/jackc/pgx/v5 (Go) Fixed in 5.9.0 Advisory →

Red Hat 19 advisories

  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:67842 Released 2026-09-16 · Red Hat rating Important
    Multicluster Global Hub 1.7.3 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
Show 16 more Red Hat advisories
  • RHSA-2026:41019 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:36796 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
  • RHSA-2026:26636 Released 2026-06-17 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-1 Update
    • Custom Metric Autoscaler 2.19 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 +1
  • RHSA-2026:25273 Released 2026-06-11 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
  • RHSA-2026:24539 Released 2026-06-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
  • RHSA-2026:24503 Released 2026-06-08 · Red Hat rating Important
    Multicluster Global Hub 1.7.1 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:24482 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9 +1
  • RHSA-2026:24479 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +5
  • RHSA-2026:24475 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/createtree-rhel9
  • RHSA-2026:22423 Released 2026-06-02 · Red Hat rating Important
    Multicluster Global Hub 1.3.4 security update
    • Multicluster Global Hub 1.3.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:13829 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.10.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:13791 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.9.6 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:11217 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2
  • RHSA-2026:11070 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    github.com/jackc/pgx/v5/pgproto3 5.9.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-26188 CVE-2026-33816 in github.com/jackc/pgxPriority MEDIUM 50
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Multicluster Global HubAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Edge Manager 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
Custom Metric Autoscaler 2.19Fixed RHSA-2026:26636
Multicluster Global Hub 1.3.4Fixed RHSA-2026:22423
Multicluster Global Hub 1.7.4Fixed RHSA-2026:24503, RHSA-2026:67842
RHEM 1.0 for RHEL 9Fixed RHSA-2026:36796
RHEM 1.1 for RHEL 10Fixed RHSA-2026:41019
RHEM 1.1 for RHEL 9Fixed RHSA-2026:41019
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:24539
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:25273
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:11070, RHSA-2026:11217
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:13791
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:13829
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:24475, RHSA-2026:24479, RHSA-2026:24482
Not affected: 22 products
  • Cryostat 4 on RHEL 9
  • Custom Metric Autoscaler 2.19
  • Multicluster Global Hub
  • Multicluster Global Hub 1.3.4
  • Multicluster Global Hub 1.7.4
  • RHEM 1.0 for RHEL 9
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.3
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Quay 3
  • Red Hat Trusted Artifact Signer 1.3
  • Zero Trust Workload Identity Manager

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33815
  2. 2026-10-03 Alias added: GHSA-xgrm-4fwx-7qm8
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-25 EPSS moved to the below the 50th percentile
  6. 2026-11-04 EPSS moved to the 50th–90th percentile
  7. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  8. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat

References

Advisory 2

Other 3

  • TI-2024-18128 pgx SQL Injection via Line Comment Creation CVSS 3.1HIGH 8.1
  • TI-2026-26188 CVE-2026-33816 in github.com/jackc/pgx CVSS 3.1CRITICAL 9.8
  • TI-2024-18142 pgx SQL Injection via Protocol Message Size Overflow CVSS 3.1CRITICAL 9.8
  • TI-2026-30292 pgx: SQL Injection via placeholder confusion with dollar quoted string literals CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences