Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/jackc/pgx/v5

4 known vulnerabilities (3 critical, 1 low), with the versions each affects and the releases that fix them.

Latest release
v5.12.0 (Oct 31, 2026): no advisory affects it
Newest unaffected release
v5.12.0 (Oct 31, 2026), the latest release
Advisories
4 · 3 critical, 1 low
Releases
45 since v5.0.0 (Sep 17, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • pgx: SQL Injection via placeholder confusion with dollar quoted string literals

    Affected: fixed in 5.9.2.

    Fixed in v5.9.2 (released Apr 19, 2026, 19 days before disclosure).

    The latest release, v5.12.0, is not affected.

  • CVE-2026-33816Critical 9.8

    CVE-2026-33816 in github.com/jackc/pgx

    Affected: fixed in 5.9.0.

    Fixed in v5.9.0 (released Mar 21, 2026, 17 days before disclosure).

    The latest release, v5.12.0, is not affected.

  • CVE-2026-33815Critical 9.8

    CVE-2026-33815 in github.com/jackc/pgx

    Affected: fixed in 5.9.0.

    Fixed in v5.9.0 (released Mar 21, 2026, 17 days before disclosure).

    The latest release, v5.12.0, is not affected.

  • CVE-2024-27304Critical 9.8

    pgx SQL Injection via Protocol Message Size Overflow

    Affected: from 5.0.0, fixed in 5.5.4.

    Fixed in v5.5.4 (released Mar 4, 2024, 2 days before disclosure).

    The latest release, v5.12.0, is not affected.