—
GO-2026-6170
Malformed backend frame length causes panic in github.com/lib/pq
상세
github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose length is zero through three produces a negative payload length. recvMessage then slices the connection scratch buffer with that negative bound, causing an unrecovered runtime panic that terminates the calling goroutine and process.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Go / github.com/lib/pq
최초 영향 버전:
1.0.0 No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.