https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T21:54:00.875022+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33816 CVE-2026-33816 — CVE-2026-33816 in github.com/jackc/pgx 2026-10-10T21:54:00.922875+00:00

Affected: github.com/jackc/pgx/v5/pgproto3, Red Hat Cryostat 4 on RHEL 9, Red Hat Enterprise Linux 10, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Custom Metric Autoscaler 2.19, Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.7.0, Red Hat Advanced Cluster Management for Kubernetes 2.15 and 21 more

Memory-safety vulnerability in github.com/jackc/pgx/v5.

 https://cve.radiocsirt.org/vuln/ghsa-j88v-2chj-qfwx GHSA-j88v-2chj-qfwx — pgx: SQL Injection via placeholder confusion with dollar quoted string literals 2026-10-10T21:54:00.923069+00:00

Affected: Go: github.com/jackc/pgx/v5, Go: github.com/jackc/pgx/v4, Go: github.com/jackc/pgx

### Impact

SQL Injection can occur when:

1. The non-default simple protocol is used. 2. A dollar quoted string literal is used in the SQL query. 3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal. 4. The value of that placeholder is controllable by the attacker.

e.g.

```go attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) ```

This is unlikely to occur outside of a contrived scenario.

### Patches

The problem is resolved in v5.9.2.

### Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.