Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

postgrex

3 known vulnerabilities (1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 high, 1 medium, 1 low
Registry
Hex

Advisories 3

  • CVE-2026-66838Medium 5.9

    SQL injection via the :comment option in Postgrex.stream/4

    Affected: from 0.19.3, fixed in 0.22.4; from 0.19.3, fixed in 0.22.4.

  • SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

    Affected: from 0.16.0, fixed in 0.22.3; from 0.16.0, fixed in 0.22.3.

  • SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3

    Affected: from 0.16.0, fixed in 0.22.2; from 0.16.0, fixed in 0.22.2.