github.com/jackc/pgx/v4
PostgreSQL driver and toolkit for Go
View on Github
Activity
- Latest release
- 2y ago
- Total releases
- 20
- Cadence
- ~30 days
- Last 12 months
- 0
Reach
- Stars
- 14.2k
Details
- First release
- Sep 26, 2020
| Version | Released | |
|---|---|---|
v4.18.3
patch
1 CVE
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev |
v4.18.3
patch
Dependencies (15)
+ 7 more |
|
v4.18.2
patch
1 CVE
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev |
v4.18.2
patch
Dependencies (15)
+ 7 more |
|
v4.18.1
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.18.1
patch
Dependencies (15)
+ 7 more |
|
v4.18.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.18.0
minor
Dependencies (15)
+ 7 more |
|
v4.17.2
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.17.2
patch
Dependencies (15)
+ 7 more |
|
v4.17.1
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.17.1
patch
Dependencies (15)
+ 7 more |
|
v4.17.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.17.0
minor
Dependencies (15)
+ 7 more |
|
v4.16.1
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.16.1
patch
Dependencies (15)
+ 7 more |
|
v4.16.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.16.0
minor
Dependencies (15)
+ 7 more |
|
v4.15.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.15.0
minor
Dependencies (15)
+ 7 more |
|
v4.14.1
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.14.1
patch
Dependencies (15)
+ 7 more |
|
v4.14.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.14.0
minor
Dependencies (15)
+ 7 more |
|
v4.13.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.13.0
minor
Dependencies (15)
+ 7 more |
|
v4.12.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.12.0
minor
Dependencies (15)
+ 7 more |
|
v4.11.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.11.0
minor
Dependencies (15)
+ 7 more |
|
v4.10.1
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.10.1
patch
Dependencies (14)
+ 6 more |
|
v4.10.0
minor
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.10.0
minor
Dependencies (14)
+ 6 more |
|
v4.9.2
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.9.2
patch
Dependencies (14)
+ 6 more |
|
v4.9.1
patch
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.9.1
patch
Dependencies (14)
+ 6 more |
|
v4.9.0
initial
3 CVEs
CVE-2026-41889
GO-2026-5004
GHSA-j88v-2chj-qfwx
Jun 22, 2026
SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx SQL Injection can occur when using the non-default simple protocol with a dollar quoted string literal in the SQL query. If that string literal contains text that would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker, an injection may be possible. For example, an attacker could provide a value that includes a closing dollar quote followed by malicious SQL commands. This is unlikely to occur outside of a contrived scenario. References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2024-27304
GO-2024-2606
GHSA-7jwh-3vrq-q3m8
GHSA-mrww-27vc-gghv
Mar 14, 2024
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size. Fixed in
4.18.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-27289
GO-2024-2605
GHSA-m7wr-2xf7-cm9p
Mar 11, 2024
SQL injection in github.com/jackc/pgx/v4 SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled. Fixed in
4.18.2
References Updated Feb 04, 2026 · Source: OSV.dev |
v4.9.0
initial
Dependencies (14)
+ 6 more |