npgsql
Npgsql is the open source .NET data provider for PostgreSQL.
View on Github
Activity
- Latest release
- 3mo ago
- Total releases
- 162
- Cadence
- ~16 days
- Last 12 months
- 9
Reach
- Stars
- —
Details
- License
- PostgreSQL
- First release
- Feb 06, 2011
| Version | Released | |
|---|---|---|
10.0.3
patch
| ||
10.0.2
patch
| ||
9.0.5
patch
| ||
8.0.9
patch
|
8.0.9
patch
Dependencies (7)
Changelog
Compare changes
|
|
10.0.1
patch
| ||
10.0.0
major
| ||
10.0.0-rc.1
pre
| ||
8.0.8
patch
|
8.0.8
patch
Dependencies (7)
Changelog
Compare changes
|
|
9.0.4
patch
| ||
7.0.10
patch
|
7.0.10
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.7
patch
|
8.0.7
patch
Dependencies (7)
Changelog
Compare changes
|
|
9.0.3
patch
| ||
9.0.2
patch
| ||
9.0.1
major
| ||
6.0.13
patch
|
6.0.13
patch
Dependencies (6)
Changelog
Compare changes
|
|
7.0.9
patch
|
7.0.9
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.6
patch
|
8.0.6
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.5
patch
|
8.0.5
patch
Dependencies (7)
Changelog
Compare changes
|
|
6.0.12
patch
|
6.0.12
patch
Dependencies (6)
Changelog
Compare changes
|
|
7.0.8
patch
|
7.0.8
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.4
patch
|
8.0.4
patch
Dependencies (7)
Changelog
Compare changes
|
|
4.0.17
patch
| ||
4.1.14
patch
|
4.1.14
patch
Dependencies (6)
Changelog
Compare changes
|
|
4.0.16
patch
| ||
7.0.7
patch
|
7.0.7
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.3
patch
|
8.0.3
patch
Dependencies (7)
Changelog
Compare changes
|
|
6.0.11
patch
|
6.0.11
patch
Dependencies (6)
Changelog
Compare changes
|
|
5.0.18
patch
| ||
4.1.13
patch
|
4.1.13
patch
Dependencies (6)
Changelog
Compare changes
|
|
4.0.14
patch
| ||
8.0.2
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
8.0.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.1
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
8.0.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.0
major
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
8.0.0
major
Dependencies (7)
Changelog
Compare changes
|
|
8.0.0-rc.2
pre
|
8.0.0-rc.2
pre
Dependencies (7)
Changelog
Compare changes
|
|
5.0.17
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
6.0.10
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.0.10
patch
Dependencies (6)
Changelog
Compare changes
|
|
7.0.6
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.6
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.0-preview.4
pre
|
8.0.0-preview.4
pre
Dependencies (7)
Changelog
Compare changes
|
|
7.0.4
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.4
patch
Dependencies (7)
Changelog
Compare changes
|
|
8.0.0-preview.3
pre
|
8.0.0-preview.3
pre
Dependencies (7)
Changelog
Compare changes
|
|
8.0.0-preview.2
pre
|
8.0.0-preview.2
pre
Dependencies (7)
Changelog
Compare changes
|
|
8.0.0-preview.1
pre
|
8.0.0-preview.1
pre
Dependencies (7)
Changelog
Compare changes
|
|
5.0.16
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
6.0.9
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.0.9
patch
Dependencies (6)
Changelog
Compare changes
|
|
7.0.2
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.2
patch
Dependencies (7)
Changelog
Compare changes
|
|
6.0.8
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.0.8
patch
Dependencies (6)
Changelog
Compare changes
|
|
7.0.1
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.1
patch
Dependencies (7)
Changelog
Compare changes
|
|
7.0.0
major
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.0
major
Dependencies (7)
Changelog
Compare changes
|
|
7.0.0-rc.2
pre
|
7.0.0-rc.2
pre
Dependencies (7)
Changelog
Compare changes
|
|
5.0.15
patch
1 CVE
CVE-2024-32655
GHSA-x9vc-6hfv-hg8c
May 09, 2024
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
SummaryThe This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. ImpactAttackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc. Affected versions
8.0.0
8.0.1
8.0.2
2.0.11
2.0.12
2.0.12.1
2.0.13-beta1
2.0.14.1
2.0.14.2
2.0.14.3
2.1.0
2.1.0-beta1
+ 121 more Show less
2.1.0-rc1
2.1.1
2.1.2
2.1.3
2.2.0
2.2.0-beta1
2.2.0-rc1
2.2.0-rc2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.4.1
2.2.4.2
2.2.4.3
2.2.5
2.2.6
2.2.7
3.0.0
3.0.0-beta0001
3.0.0-rc0001
3.0.0-rc0002
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.0-alpha1
3.1.0-alpha2
3.1.0-alpha3
3.1.0-alpha4
3.1.0-alpha5
3.1.0-alpha6
3.1.0-beta0001
3.1.1
3.1.10
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.0-beta1
3.2.1
3.2.2
3.2.3
3.2.4
3.2.4.1
3.2.5
3.2.6
3.2.7
4.0.0
4.0.0-preview1
4.0.0-preview2
4.0.0-rc1
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.2
4.1.3
4.1.3.1
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
5.0.0
5.0.1
5.0.1.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
6.0.0
6.0.1
6.0.10
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.0.0
7.0.1
7.0.2
7.0.4
7.0.6
Fixed in
4.0.14
4.1.13
5.0.18
6.0.11
7.0.7
8.0.3
References
Updated Sep 10, 2026 · Source: OSV.dev |