CVE-2026-33816 — CVE-2026-33816 in github.com/jackc/pgx

Affected: github.com/jackc/pgx/v5/pgproto3, Red Hat Cryostat 4 on RHEL 9, Red Hat Enterprise Linux 10, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Custom Metric Autoscaler 2.19, Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.7.0, Red Hat Advanced Cluster Management for Kubernetes 2.15 and 21 more

Memory-safety vulnerability in github.com/jackc/pgx/v5.

GHSA-j88v-2chj-qfwx — pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Affected: Go: github.com/jackc/pgx/v5, Go: github.com/jackc/pgx/v4, Go: github.com/jackc/pgx

### Impact

SQL Injection can occur when:

1. The non-default simple protocol is used. 2. A dollar quoted string literal is used in the SQL query. 3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal. 4. The value of that placeholder is controllable by the attacker.

e.g.

```go attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) ```

This is unlikely to occur outside of a contrived scenario.

### Patches

The problem is resolved in v5.9.2.

### Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.

Most recent entries from all

CVE-2026-33816 — CVE-2026-33816 in github.com/jackc/pgx

GHSA-j88v-2chj-qfwx — pgx: SQL Injection via placeholder confusion with dollar quoted string literals