ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32286

The DataRow.Decode function fails to properly validate field lengths.

Published Mar 26, 2026 · updated Sep 10, 2026 · jackc pgproto3

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 26, 2026 · NIST NVD

    Detected

    The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

  2. Sep 10, 2026 · NIST NVD

    Updated

    The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

Affected

  • cpe jackc/pgproto3version unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-32286

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32286

    The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

    nvd.nist.gov

References