CVE-2026-33816: github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3 Out-of-bounds Write

CVSS: 9.8v3.1CriticalModified

AliasesRHSA-2026:13907UBUNTU-CVE-2026-33816DEBIAN-CVE-2026-33816+408 more

Published 07-04-2026Last modified 11-09-2026

Vulnerability summary

CVE-2026-33816 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.7% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.86%

0%100%

Low · +0.30 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 5

OPENSUSE-SU-2026:21483-1 RHSA-2026:19137 RHSA-2026:36796 RHSA-2026:41019 CGA-93C9-W6Q6-9VF3

Timeline

07-04-2026
PublishedVulnerability first disclosed.
11-09-2026
Last modifiedVulnerability information updated.

Description

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVSS metrics

8 scores · 8 sources · 1 version

v3.19.8

EPSS trend

Probability

0.86%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

+0.30 pp

From 0.56% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.86%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Chainguard200 products

argo-workflow-controller-3.7All versions (No fix recorded)
argo-workflow-controller-4.0All versions (No fix recorded)
argo-workflow-controller-fips-3.7All versions (No fix recorded)
argo-workflow-controller-fips-4.0All versions (No fix recorded)
argo-workflow-executor-3.7All versions (No fix recorded)

argo-workflow-executor-4.0All versions (No fix recorded)
argo-workflow-executor-fips-3.7< 3.7.13-r6
argo-workflow-executor-fips-4.0< 4.0.4-r6
argo-workflows-3.7All versions (No fix recorded)
argo-workflows-4.0All versions (No fix recorded)
argo-workflows-fips-3.7All versions (No fix recorded)
argo-workflows-fips-4.0All versions (No fix recorded)
authentik-2025.12-go-serverAll versions (No fix recorded)
authentik-2026.2-go-serverAll versions (No fix recorded)
authentik-fips-2025.12-go-serverAll versions (No fix recorded)
authentik-fips-2026.2-go-serverAll versions (No fix recorded)
azure-service-operatorAll versions (No fix recorded)
azure-service-operator-fipsAll versions (No fix recorded)
bentoAll versions (No fix recorded)
bento-fipsAll versions (No fix recorded)
caddyAll versions (No fix recorded)
caddy-fipsAll versions (No fix recorded)
cerbosAll versions (No fix recorded)
cerbos-fipsAll versions (No fix recorded)
certificate-transparency-fips-trillian-ctserverAll versions (No fix recorded)
certificate-transparency-trillian-ctserverAll versions (No fix recorded)
chainloop-control-planeAll versions (No fix recorded)
chainloop-control-plane-fipsAll versions (No fix recorded)
cloudnative-pgAll versions (No fix recorded)
cloudnative-pg-fipsAll versions (No fix recorded)
cloudnative-pg-fips-plugins< 1.29.0-r2
cloudnative-pg-plugins< 1.29.0-r3
cloudproberAll versions (No fix recorded)
cloudprober-fipsAll versions (No fix recorded)
commercial-chainloop-backend< 1.72.2-r0
commercial-expanso-edge< 2.1.17-r0
commercial-grafana-11.6< 11.6.16-r0
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2< 12.2.10-r0
commercial-grafana-12.3< 12.3.8-r0
commercial-grafana-12.4< 12.4.5-r0
dapr-daprd-1.14All versions (No fix recorded)
dapr-daprd-1.15All versions (No fix recorded)
dapr-daprd-1.16All versions (No fix recorded)
dapr-daprd-1.17All versions (No fix recorded)
dapr-daprd-fips-1.14All versions (No fix recorded)
dapr-daprd-fips-1.15All versions (No fix recorded)
dapr-daprd-fips-1.16All versions (No fix recorded)
dapr-daprd-fips-1.17All versions (No fix recorded)
envoy-gateway-egctl< 1.7.2-r1
envoy-gateway-fips-1.6-egctl< 1.6.7-r4
envoy-gateway-fips-egctl< 1.7.2-r1
falcosidekickAll versions (No fix recorded)
falcosidekick-fipsAll versions (No fix recorded)
ferretdbAll versions (No fix recorded)
flyteAll versions (No fix recorded)
gitaly-18.10All versions (No fix recorded)
gitaly-18.11All versions (No fix recorded)
gitaly-18.6All versions (No fix recorded)
gitaly-18.7All versions (No fix recorded)
gitaly-18.8All versions (No fix recorded)
gitaly-18.9All versions (No fix recorded)
gitaly-fips-18.10All versions (No fix recorded)
gitaly-fips-18.11All versions (No fix recorded)
gitaly-fips-18.6All versions (No fix recorded)
gitaly-fips-18.7All versions (No fix recorded)
gitaly-fips-18.8All versions (No fix recorded)
gitaly-fips-18.9All versions (No fix recorded)
gitlab-container-registry-18.10All versions (No fix recorded)
gitlab-container-registry-18.11All versions (No fix recorded)
gitlab-container-registry-18.7All versions (No fix recorded)
gitlab-container-registry-18.8All versions (No fix recorded)
gitlab-container-registry-18.9All versions (No fix recorded)
gitlab-container-registry-fips-18.10All versions (No fix recorded)
gitlab-container-registry-fips-18.11All versions (No fix recorded)
gitlab-container-registry-fips-18.7All versions (No fix recorded)
gitlab-container-registry-fips-18.8All versions (No fix recorded)
gitlab-container-registry-fips-18.9All versions (No fix recorded)
gitlab-elasticsearch-indexerAll versions (No fix recorded)
gitlab-elasticsearch-indexer-fipsAll versions (No fix recorded)
gitnessAll versions (No fix recorded)
gooseAll versions (No fix recorded)
goose-fipsAll versions (No fix recorded)
grafana-11.5All versions (No fix recorded)
grafana-11.6All versions (No fix recorded)
grafana-12.0All versions (No fix recorded)
grafana-12.1All versions (No fix recorded)
grafana-fips-11.5All versions (No fix recorded)
grafana-fips-11.6All versions (No fix recorded)
grafana-fips-12.0All versions (No fix recorded)
grafana-fips-12.1All versions (No fix recorded)
grafana-fips-12.2All versions (No fix recorded)
hydraAll versions (No fix recorded)
hydra-fipsAll versions (No fix recorded)
jitsucom-bulker-bulkerAll versions (No fix recorded)
jitsucom-bulker-sidecarAll versions (No fix recorded)
jitsucom-bulker-syncctlAll versions (No fix recorded)
juicefs-1.2All versions (No fix recorded)
juicefs-1.3All versions (No fix recorded)
k3s< 1.35.3.1-r3
k3s-1.31< 1.31.6.1-r18
k3s-1.32< 1.32.13.1-r12
k3s-1.33< 1.33.10.1-r7
k3s-1.34< 1.34.6.1-r3
k3s-1.35< 1.35.3.1-r2
k3s-static< 1.35.3.1-r3
k3s-static-1.31< 1.31.6.1-r18 | < 1.31.6.1-r19
k3s-static-1.32< 1.32.13.1-r12
k3s-static-1.33< 1.33.10.1-r7
k3s-static-1.34< 1.34.6.1-r3
k3s-static-1.35< 1.35.3.1-r2
keda-2.17All versions (No fix recorded)
keda-2.17-metrics-apiserverAll versions (No fix recorded)
keda-2.18All versions (No fix recorded)
keda-2.18-metrics-apiserverAll versions (No fix recorded)
keda-2.19All versions (No fix recorded)
keda-2.19-metrics-apiserverAll versions (No fix recorded)
keda-fips-2.17All versions (No fix recorded)
keda-fips-2.17-metrics-apiserverAll versions (No fix recorded)
keda-fips-2.18All versions (No fix recorded)
keda-fips-2.18-metrics-apiserverAll versions (No fix recorded)
keda-fips-2.19All versions (No fix recorded)
keda-fips-2.19-metrics-apiserverAll versions (No fix recorded)
kine< 0.14.16-r2
kots< 1.130.0-r5
kube-benchAll versions (No fix recorded)
kube-bench-fipsAll versions (No fix recorded)
kubeflow-pipelines-apiserverAll versions (No fix recorded)
kuma-cp-2.10All versions (No fix recorded)
kuma-cp-2.11All versions (No fix recorded)
kuma-cp-2.12All versions (No fix recorded)
kuma-cp-2.13All versions (No fix recorded)
kuma-cp-2.7All versions (No fix recorded)
kuma-cp-2.9All versions (No fix recorded)
kuma-dp-2.10All versions (No fix recorded)
kuma-dp-2.11All versions (No fix recorded)
kuma-dp-2.12All versions (No fix recorded)
kuma-dp-2.13All versions (No fix recorded)
kuma-dp-2.7All versions (No fix recorded)
kuma-dp-2.9All versions (No fix recorded)
kumactl-2.10All versions (No fix recorded)
kumactl-2.11All versions (No fix recorded)
kumactl-2.12All versions (No fix recorded)
kumactl-2.13All versions (No fix recorded)
kumactl-2.7All versions (No fix recorded)
kumactl-2.9All versions (No fix recorded)
migrateAll versions (No fix recorded)
openbaoAll versions (No fix recorded)
openbao-fipsAll versions (No fix recorded)
ory-kratosAll versions (No fix recorded)
ory-kratos-fipsAll versions (No fix recorded)
pg_timetableAll versions (No fix recorded)
pg_timetable-fipsAll versions (No fix recorded)
pgwatchAll versions (No fix recorded)
rke2-cloud-providerAll versions (No fix recorded)
rke2-cloud-provider-fipsAll versions (No fix recorded)
rke2-runtime-1.31All versions (No fix recorded)
rke2-runtime-1.32All versions (No fix recorded)
rke2-runtime-1.33All versions (No fix recorded)
rke2-runtime-1.34All versions (No fix recorded)
rke2-runtime-1.35All versions (No fix recorded)
rke2-runtime-fips-1.31All versions (No fix recorded)
rke2-runtime-fips-1.32All versions (No fix recorded)
rke2-runtime-fips-1.33All versions (No fix recorded)
rke2-runtime-fips-1.34All versions (No fix recorded)
rke2-runtime-fips-1.35All versions (No fix recorded)
seaweedfsAll versions (No fix recorded)
seaweedfs-fipsAll versions (No fix recorded)
seaweedfs-rocksdbAll versions (No fix recorded)
seaweedfs-rocksdb-fipsAll versions (No fix recorded)
sftpgoAll versions (No fix recorded)
sftpgo-plugin-eventsearchAll versions (No fix recorded)
sftpgo-plugin-eventstoreAll versions (No fix recorded)
spicedbAll versions (No fix recorded)
spicedb-fipsAll versions (No fix recorded)
spire-server< 1.14.5-r1
spire-server-fipsAll versions (No fix recorded)
spqrAll versions (No fix recorded)
steampipeAll versions (No fix recorded)
stepAll versions (No fix recorded)
step-caAll versions (No fix recorded)
step-ca-fipsAll versions (No fix recorded)
step-fipsAll versions (No fix recorded)
step-issuerAll versions (No fix recorded)
step-issuer-fipsAll versions (No fix recorded)
teleport-16All versions (No fix recorded)
teleport-17All versions (No fix recorded)
teleport-18All versions (No fix recorded)
teleport-18.6All versions (No fix recorded)
temporalAll versions (No fix recorded)
temporal-fipsAll versions (No fix recorded)
temporal-serverAll versions (No fix recorded)
temporal-server-fipsAll versions (No fix recorded)
temporal-sql-toolAll versions (No fix recorded)
temporal-sql-tool-fipsAll versions (No fix recorded)
timescaledb-parallel-copyAll versions (No fix recorded)
vault-1.20All versions (No fix recorded)
vault-1.21All versions (No fix recorded)
vault-fips-1.20All versions (No fix recorded)
vault-fips-1.21All versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 287. Use Open JSON for the complete list.

References

37 links

pkg.go.dev/vuln/GO-2026-4772AdvisoryREPORTWEBThird Party Advisory
access.redhat.com/security/cve/CVE-2026-33816VDB EntryX Refsource REDHATREPORTAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2455972Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33816.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:41019Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:17789Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:36796Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19137Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26636Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:62866Vendor AdvisoryX Refsource REDHATAdvisory

Show all 37 references

access.redhat.com/errata/RHSA-2026:22423Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:24503Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:24539Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:25273Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:11070Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:11217Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:13791Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:13829Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:40945Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:40118Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:13907Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26519Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:40984Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:24479Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:24475Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:24482Vendor AdvisoryX Refsource REDHATAdvisory
images.redhat.comARTICLE
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13907.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2026-33816AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-33816Advisory
ubuntu.com/security/CVE-2026-33816REPORT
security-tracker.debian.org/tracker/CVE-2026-33816Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33816.jsonAdvisory
github.com/jackc/pgxPACKAGE
www.suse.com/security/cve/CVE-2026-33816WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities