CVE-2026-32286
Published: 26 March 2026
Summary
CVE-2026-32286 is a high-severity Improper Validation of Array Index (CWE-129) vulnerability in Jackc Pgproto3. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 21.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32286 affects the DataRow.Decode function in Go-based PostgreSQL client libraries, such as pgx and pgproto3, which parse the PostgreSQL wire protocol. The vulnerability arises from improper validation of field lengths, allowing a malicious or compromised PostgreSQL server to send a DataRow message with a negative field length. This triggers a slice bounds out of range panic in the client application. Published on 2026-03-26, it has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact.
Any remote unauthenticated attacker with network access who controls or compromises a PostgreSQL server can exploit this vulnerability. By crafting and sending a DataRow message with a negative field length during a client connection, the attacker causes an immediate panic in the vulnerable client library. This results in denial of service, as the client process crashes without impacting confidentiality or integrity.
Advisories detail mitigations in GHSA-jqcq-xjh3-6g23, golang/vulndb issue #4518, jackc/pgx issue #2507, and pkg.go.dev/vuln/GO-2026-4518. Security practitioners should update to patched versions of affected libraries like pgx. Further analysis of memory safety issues in Go PostgreSQL wire protocol parsers appears in securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16347
Vulnerability details
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a wire-protocol parsing flaw in PostgreSQL clients that a malicious server can trigger with a single crafted DataRow message, directly causing a process panic and crash; this maps to application exploitation for endpoint denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of field lengths in DataRow messages from PostgreSQL servers to prevent slice out-of-bounds panics in client libraries.
Mandates timely remediation by patching vulnerable Go PostgreSQL client libraries like pgx and pgproto3 to fix the decoding flaw.
Ensures graceful error handling for malformed DataRow messages to avoid application crashes and mitigate denial-of-service impact.