—
GO-2026-6171
Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq
Details
github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send malformed row responses, causing unrecovered runtime panics while reading query results.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/lib/pq
Introduced in:
1.0.0 No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.