Vulnerability details
CVE-2026-32286
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2Red Hat Multicluster Engine for KubernetesRed Hat Advanced Cluster Management for Kubernetes 2Red Hat Enterprise Linux 8Red Hat OpenShift AIRed Hat OpenShift Cluster Manager CLI
Denial of service in github.com/jackc/pgproto3/v2
CVSS 3.1
7.5High
Official description
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Cluster Manager CLI | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift on AWS | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | All | CVEProject cvelistV5 (CNA) |
References and advisories
23- https://github.com/advisories/GHSA-jqcq-xjh3-6g23
- https://github.com/jackc/pgx/issues/2507
- https://github.com/golang/vulndb/issues/4518
- https://pkg.go.dev/vuln/GO-2026-4518
- https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx exploit
- https://access.redhat.com/security/cve/CVE-2026-32286 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2451847 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32286.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:22450 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22714 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22423 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22347 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23345 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11070 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11217 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11916 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11856 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21017 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24853 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19375 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22465 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11996 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21769 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-26
- Last updated
- 2026-09-10
- State
- Published
- Assigner (CNA)
- Go
Exploit prediction (EPSS)
0.67%
Probability of exploitation in 30 days
52.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-1285Improper Validation of Specified Index, Position, or Offset in Input