—
GO-2026-6170
Malformed backend frame length causes panic in github.com/lib/pq
Details
github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose length is zero through three produces a negative payload length. recvMessage then slices the connection scratch buffer with that negative bound, causing an unrecovered runtime panic that terminates the calling goroutine and process.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/lib/pq
Introduced in:
1.0.0 No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.