Cyber Resilience

CVE-2026-33815

CriticalUpdated

Published: 07 April 2026

Published
07 April 2026
Modified
30 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 32.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-33815 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Jackc Pgx. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-33815 is a memory-safety vulnerability in the github.com/jackc/pgx/v5 PostgreSQL driver for Go. Published on 2026-04-07T16:16:24.813, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE category NVD-CWE-noinfo.

The vulnerability enables exploitation over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful attacks can achieve high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or data compromise in affected applications using the pgx/v5 library.

Mitigation details are available in the Go vulnerability advisory at https://pkg.go.dev/vuln/GO-2026-4771.

EU & UK References

Vulnerability details

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CWE(s)
NVD-CWE-noinfoCWE-787

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated memory-safety vulnerability enabling arbitrary code execution in Go applications using the library directly maps to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-33816Same product: Jackc Pgx
CVE-2026-32286Same vendor: Jackc

Affected Assets

jackc
pgx
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely identification, reporting, and patching of known software flaws like the memory-safety vulnerability in pgx/v5 to prevent exploitation.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning and monitoring to identify deployments using vulnerable versions of the pgx/v5 PostgreSQL driver.

SI-16 Memory Protection partial match
prevent

Implements memory protections such as non-executable memory regions and randomization to mitigate exploitation of memory-safety bugs in pgx/v5.

References