CVE catalog

CVE-2026-33816

Memory-safety vulnerability in github.com/jackc/pgx/v5.

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.56% · Oct 25, 2026

A flaw was found in github.com/jackc/pgx, a PostgreSQL driver for Go. This memory-safety vulnerability could allow an attacker to cause various impacts, such as denial of service (DoS) or potentially arbitrary code execution, by exploiting memory corruption issues. The exact method of exploitation and specific consequences would depend on the nature of the memory corruption. github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpepgxNot reported5.9.0fixed
CpepgxNot reported5.9.0fixed
Debiangolang-github-jackc-pgx-v5145.8.0-1vulnerable
Debiangolang-github-jackc-pgx-v5145.9.2-1fixed
Opensusekubectl-cnpgtumbleweed1.29.1-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpepgxcpeNot reported5.9.0Not reportedNot reportedNot reported
CpepgxcpeNot reported5.9.0Not reportedNVD-CVE-2026-33816Not reported
Debiangolang-github-jackc-pgx-v5deb145.9.2-1Not reportedDEBIAN-CVE-2026-33816Not reported
Opensusekubectl-cnpgrpmtumbleweed1.29.1-1.1Not reportedOPENSUSE-SU-2026:10754-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [kubectl-cnpg-bash-completion]Unknown

    Source package: [kubectl-cnpg]

    Details (1)

    • 1.29.2-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.29.1-1.1

      Version impact unknown

      nvd · kubectl-cnpg · opensuse · tumbleweed

  • [kubectl-cnpg-fish-completion]Unknown

    Source package: [kubectl-cnpg]

    Details (1)

    • 1.29.2-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.29.1-1.1

      Version impact unknown

      nvd · kubectl-cnpg · opensuse · tumbleweed

  • [kubectl-cnpg-zsh-completion]Unknown

    Source package: [kubectl-cnpg]

    Details (1)

    • 1.29.2-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.29.1-1.1

      Version impact unknown

      nvd · kubectl-cnpg · opensuse · tumbleweed

  • [kubectl-cnpg]Fixed

    Source package: [kubectl-cnpg]

    Details (1)

    • 1.29.2-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.29.1-1.1

      nvd · kubectl-cnpg · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]