CVE-2026-33815: github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3 Out-of-bounds Write
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2026-33815DEBIAN-CVE-2026-33815CGA-3phc-h5w7-vc6xCGA-5chx-gp4x-wq66CGA-hggf-43qw-837mCGA-hm78-h8jc-683gCGA-jj6f-2794-chfgCGA-mpm3-w8p9-6rj4CGA-qv76-vgp7-pv87CGA-vxx7-3gc8-qpmxGHSA-xgrm-4fwx-7qm8GO-2026-4771CGA-224f-9vjm-wx6fCGA-289h-vh6v-fx8qCGA-28mr-36qf-3rhxCGA-2r6q-v673-3qfrCGA-2r8w-7r3j-qq5xCGA-2v95-c645-pwwjCGA-4fgm-469c-mhqqCGA-5vc7-4jmw-c3m9CGA-5vff-hm99-2fq6CGA-6mvx-5w2g-gjgrCGA-746r-5w7h-jh5vCGA-79jf-2245-jm83CGA-832f-4x45-g3w4CGA-8wjr-v647-pm3qCGA-8wvh-8f9m-6mphCGA-9g5p-gc5v-qq4jCGA-9gpm-p99c-m2xcCGA-9v5q-27vq-5rmwCGA-9xrp-55gc-x358CGA-f97r-4g99-7rv7CGA-ff87-g3hp-f56mCGA-fg96-2rpv-6xcfCGA-fm4p-x44g-5q3pCGA-fwv4-c74r-cm57CGA-fxvv-q72g-6pv2CGA-g7xg-p9ww-6j96CGA-gw2w-mwcf-522vCGA-jrf9-r8g9-r84cCGA-mpr2-6qg2-pqqvCGA-pcg2-c632-4mr9CGA-pg69-gmf6-rh7fCGA-pj85-6h75-f92qCGA-pw5w-g59h-p88wCGA-q4w8-phwc-x692CGA-qgrr-x7jc-2258CGA-r29w-2w6r-4m4xCGA-r53g-hg2h-c6m2CGA-r98w-xpr4-782hCGA-v466-c78p-7862CGA-vp3c-r882-w8hcCGA-w8m4-36c2-c3rxCGA-wjj2-x3xf-xgp6CGA-wqv4-vr38-jjjvCGA-wr64-5w7h-64x9CGA-x6gx-49h6-gx5gCGA-xgc6-x77p-c756CGA-xm8g-f9c6-m7qf
Published 07-04-2026Last modified 17-09-2026
Some data may be incomplete
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2026-33815 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.7% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.86%
0%100%
Low · +0.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 8Timeline
- 07-04-2026PublishedVulnerability first disclosed.
- 17-09-2026Last modifiedVulnerability information updated.
Description
Memory-safety vulnerability in github.com/jackc/pgx/v5.
CVSS metrics
7 scores · 7 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources7 sources · 8.3–9.8
- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.86%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
+0.25 pp
From 0.60% on 19-09-2026
19-09-202619-10-2026
EPSS score0.86%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard26 products
- commercial-grafana-11.6< 11.6.16-r0
- commercial-grafana-12.1All versions (No fix recorded)
- commercial-grafana-12.2< 12.2.10-r0
- commercial-grafana-12.3< 12.3.8-r0
- commercial-grafana-12.4< 12.4.5-r0
Wolfi2 products
- gitaly-18.11< 18.11.6-r1
- teleport-18.6< 18.6.8-r22
Debian1 product
- golang-github-jackc-pgx-v5< 5.9.2-1
Github.com/jackc/pgx1 product
- v5< 5.9.0
Github.com/jackc/pgx/v51 product
Ubuntu1 product
- golang-github-jackc-pgx-v5All versions (No fix recorded)
6 vendors · 32 products
