GHSA-jqcq-xjh3-6g23: Denial of service in github.com/jackc/pgproto3/v2

March 18, 2026

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

References

github.com/advisories/GHSA-jqcq-xjh3-6g23
github.com/golang/vulndb/issues/4518
github.com/jackc/pgproto3
github.com/jackc/pgx/issues/2507
securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx

Code Behaviors & Features

Detect and mitigate GHSA-jqcq-xjh3-6g23 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →