CVE-2024-27304

9.8 criticalEPSS 1.1%

Critical (9.8) in jackc. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in github.com/jackc/pgproto3 2.3.3.

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-190
Published: 2024-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jackc:pgproto3
jackc:pgx

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-7jwh-3vrq-q3m8	Go	github.com/jackc/pgproto3	<2.3.3	2.3.3
GHSA-7jwh-3vrq-q3m8	Go	github.com/jackc/pgproto3/v2	<2.3.3	2.3.3
GHSA-mrww-27vc-gghv	Go	github.com/jackc/pgx	<4.18.2	4.18.2
GHSA-mrww-27vc-gghv	Go	github.com/jackc/pgx	>=5.0.0 <5.5.4	5.5.4
GHSA-mrww-27vc-gghv	Go	github.com/jackc/pgx/v4	<4.18.2	4.18.2
GHSA-mrww-27vc-gghv	Go	github.com/jackc/pgx/v5	>=5.0.0 <5.5.4	5.5.4
GO-2024-2606	Go	github.com/jackc/pgproto3/v2	<2.3.3	2.3.3
GO-2024-2606	Go	github.com/jackc/pgx	all versions	no fix published
GO-2024-2606	Go	github.com/jackc/pgx/v4	<4.18.2	4.18.2
GO-2024-2606	Go	github.com/jackc/pgx/v5	>=5.0.0 <5.5.4	5.5.4

References

Check your stack JSON