VDB
KO

GO-2026-6173

Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq

Details

The special-case parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls bufio.Reader.ReadString(0) without a byte limit. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send an error message response with non-NUL bytes continuously, causing the client to buffer an arbitrarily large string and crash with an unrecoverable out-of-memory error.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/lib/pq
Introduced in: 1.11.0

No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.

References