Open-source package vulnerability · Go
CVE-2026-33815: pgx contains memory-safety vulnerability
criticalCVSS 3.1 9.8GHSA-xgrm-4fwx-7qm8
pgx is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.
Published Apr 7, 2026 · Updated Jun 26, 2026
Affected packages
github.com/jackc/pgx/v5
- Ecosystem
- Go
- Affected
- < 5.9.0
- Fixed in
- 5.9.0
- Check
go list -m github.com/jackc/pgx/v5
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
[pgx](github.com/jackc/pgx/v5) is a pure Go driver and toolkit for PostgreSQL. pgx prior to v5.9.0 contains a memory-safety vulnerability.
Credited to mitar, dor-hayun.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology