DataRow Message Vulnerability in PostgreSQL Server by Jackc
CVE-2026-32286
7.5HIGH
Key Information:
- Vendor
Github.com/jackc/pgproto3/v2
- Vendor
- CVE Published:
- 26 March 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-32286?
A vulnerability exists within the DataRow.Decode function of the PostgreSQL server, where it inadequately checks field lengths. An attacker utilizing a malicious PostgreSQL server could send a DataRow message with a negative field length, resulting in a slice bounds out of range panic condition. This flaw underscores the critical need for robust input validation and enhanced security measures when handling data from external sources.
Affected Version(s)
github.com/jackc/pgproto3/v2 0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.