Critical 9.8Published Apr 7, 2026

CVE-2026-33816CVE-2026-33816 in github.com/jackc/pgx

Updated under an hour ago (Oct 27, 2026, 3:23 PM ET)

Does this affect you?

It affects github.com/jackc/pgx/v5/pgproto3 and 17 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for github.com/jackc/pgx/v5/pgproto3

Exploited in the last 30 days

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-697, CWE-787
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Go
NVD analysis: Modified
Record last updated: Sep 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3 github.com_jackc_pgx_v5:pgproto3 (from the name)	before 5.9.0	CNA record
Red Hat Cryostat 4 on RHEL 9 redhat:cryostat	from 4.2.0-13 not affected	CISA ADP
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:1.0.1-1.el10_2 not affected	CISA ADP
Red Hat RHEM 1.0 for RHEL 9 redhat:edge_manager	from 0:1.0.3-1.el9em not affected	CISA ADP
Red Hat Custom Metric Autoscaler 2.19 redhat:openshift_custom_metrics_autoscaler	from 1780101236 not affected; from 1788361753 not affected	CISA ADP
Red Hat Multicluster Global Hub 1.3.4 redhat:multicluster_globalhub	from 1779210675 not affected	CISA ADP
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 redhat:acm	from 1780677003 not affected	CISA ADP
Red Hat Red Hat Advanced Cluster Security 4.8 redhat:advanced_cluster_security	from 1777307791 not affected	CISA ADP
Red Hat Red Hat Hardened Images redhat:hummingbird	from 1.0.1-0.1.hum1 not affected	CISA ADP
Red Hat Red Hat Openshift Data Foundation 4.20 redhat:openshift_data_foundation	from 1783667125 not affected	CISA ADP
1–10 of 18

References

References

https://pkg.go.dev/vuln/GO-2026-4772	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:11070
https://access.redhat.com/errata/RHSA-2026:11217
https://access.redhat.com/errata/RHSA-2026:13791
https://access.redhat.com/errata/RHSA-2026:13829
https://access.redhat.com/errata/RHSA-2026:13907
https://access.redhat.com/errata/RHSA-2026:17789
https://access.redhat.com/errata/RHSA-2026:19137
https://access.redhat.com/errata/RHSA-2026:22423
https://access.redhat.com/errata/RHSA-2026:24475
1–10 of 25

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.