Read the docs
TI-2026-26188 Aliases CVE-2026-33816GHSA-9jj7-4m8r-rfcm

CVE-2026-33816 in github.com/jackc/pgx

Priority MEDIUM 50CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 20 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00583 48th percentileScored 2026-11-07
Fix Partial github.com/jackc/pgx/v5/pgproto3 (github.com/jackc/pgx/v5): 5.9.0github.com/jackc/pgx/v5 (Go): 5.9.0Red Hat: 24 advisoriesRed Hat: 20 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
github.com/jackc/pgx/v5github.com/jackc/pgx/v5/pgproto3before 5.9.05.9.0Patch availableCNA
—github.com/jackc/pgx/v5 (Go)before 5.9.05.9.0Patch availableGHSA-9jj7-4m8r-rfcm
  • github.com/jackc/pgx/v5/pgproto3 Vendorgithub.com/jackc/pgx/v5 Affected before 5.9.0 Fixed in 5.9.0 Patch available CNA
  • github.com/jackc/pgx/v5 (Go) Vendor— Affected before 5.9.0 Fixed in 5.9.0 Patch available GHSA-9jj7-4m8r-rfcm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jackc:pgx:*:*:*:*:*:go:*:*before 5.9.0Vulnerablejackc
  • cpe:2.3:a:jackc:pgx:*:*:*:*:*:go:*:* Versions before 5.9.0 Vulnerable ·jackc

Remediation

  • Fix · CNA github.com/jackc/pgx/v5/pgproto3 (github.com/jackc/pgx/v5) Fixed in 5.9.0
  • Fix · GHSA-9jj7-4m8r-rfcm github.com/jackc/pgx/v5 (Go) Fixed in 5.9.0 Advisory →

Red Hat 24 advisories

  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:72881 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +3
  • RHSA-2026:62866 Released 2026-09-02 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-3 This version is a rebuild of 2.19.0 using a newer base image, Go modules and Go compiler, and two bug fixes. See the release notes for more information.
    • Custom Metric Autoscaler 2.19 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9 +5
Show 21 more Red Hat advisories
  • RHSA-2026:41019 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:40945 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:40118 Released 2026-07-15 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:36796 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
  • RHSA-2026:26636 Released 2026-06-17 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-1 Update
    • Custom Metric Autoscaler 2.19 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 +1
  • RHSA-2026:26519 Released 2026-06-17 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.21.2
    • Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel9, registry.redhat.io/openshift-pipelines/pipelines-results-api-rhel9, registry.redhat.io/openshift-pipelines/pipelines-rhel9-operator
  • RHSA-2026:25273 Released 2026-06-11 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
  • RHSA-2026:24539 Released 2026-06-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
  • RHSA-2026:24503 Released 2026-06-08 · Red Hat rating Important
    Multicluster Global Hub 1.7.1 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:24482 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9 +1
  • RHSA-2026:24479 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +5
  • RHSA-2026:24475 Released 2026-06-08 · Red Hat rating Important
    RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/createtree-rhel9
  • RHSA-2026:22423 Released 2026-06-02 · Red Hat rating Important
    Multicluster Global Hub 1.3.4 security update
    • Multicluster Global Hub 1.3.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:19137 Released 2026-05-19 · Red Hat rating Important
    go-fdo-server security update
    • Red Hat Enterprise Linux AppStream (v. 10) go-fdo-server-1.0.1-1.el10_2, go-fdo-server-manufacturer-1.0.1-1.el10_2, go-fdo-server-owner-1.0.1-1.el10_2 +1
  • RHSA-2026:13907 Released 2026-05-06 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images go-fdo-server-1.0.1-0.1.hum1@aarch64, go-fdo-server-1.0.1-0.1.hum1@src, go-fdo-server-1.0.1-0.1.hum1@x86_64 +6
  • RHSA-2026:13829 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.10.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:13791 Released 2026-05-05 · Red Hat rating Important
    RHACS 4.9.6 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:11217 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2
  • RHSA-2026:11070 Released 2026-04-27 · Red Hat rating Important
    RHACS 4.8.11 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    github.com/jackc/pgx/v5/pgproto3 5.9.0

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-26187 CVE-2026-33815 in github.com/jackc/pgxPriority MEDIUM 50
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Multicluster Global HubAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Edge Manager 1AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
Custom Metric Autoscaler 2.19Fixed RHSA-2026:26636, RHSA-2026:62866
Multicluster Global Hub 1.3.4Fixed RHSA-2026:22423
Multicluster Global Hub 1.7.4Fixed RHSA-2026:24503
RHEM 1.0 for RHEL 9Fixed RHSA-2026:36796
RHEM 1.1 for RHEL 10Fixed RHSA-2026:41019
RHEM 1.1 for RHEL 9Fixed RHSA-2026:41019
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:72881
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:24539
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:25273
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:11070, RHSA-2026:11217
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:13791
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:13829
Red Hat Edge Manager 1.1Fixed RHSA-2026:40118, RHSA-2026:40945
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:19137
Red Hat Hardened ImagesFixed RHSA-2026:13907
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift Pipelines 1.21Fixed RHSA-2026:26519
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:24475, RHSA-2026:24479, RHSA-2026:24482
Not affected: 25 products
  • Cryostat 4 on RHEL 9
  • Custom Metric Autoscaler 2.19
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Multicluster Global Hub
  • Multicluster Global Hub 1.3.4
  • Multicluster Global Hub 1.7.4
  • RHEM 1.0 for RHEL 9
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Edge Manager 1.1
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Pipelines 1.21
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Quay 3
  • Red Hat Trusted Artifact Signer 1.3
  • Zero Trust Workload Identity Manager

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33816
  2. 2026-10-03 Alias added: GHSA-9jj7-4m8r-rfcm
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-25 EPSS moved to the below the 50th percentile
  6. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  7. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat

References

Advisory 2

Other 1

  • TI-2024-18128 pgx SQL Injection via Line Comment Creation CVSS 3.1HIGH 8.1
  • TI-2026-26187 CVE-2026-33815 in github.com/jackc/pgx CVSS 3.1CRITICAL 9.8
  • TI-2024-18142 pgx SQL Injection via Protocol Message Size Overflow CVSS 3.1CRITICAL 9.8
  • TI-2026-30292 pgx: SQL Injection via placeholder confusion with dollar quoted string literals CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences