CVE found in package

[the-hotmann]

Hi, just wanted to info, that my CVE monitor alerted that this package has some (4-5h ago detected) CVEs related to Memory-safety.

1. GHSA-xgrm-4fwx-7qm8
2. GHSA-9jj7-4m8r-rfcm

Hope you @jackc are aware of it :)

[jackc]

Those reports are exceptionally short on details. But presumably it refers to #2519 which was fixed in 6dbad4c. This commit was released as part of v5.9.0 on March 21, 2026.

I don't know why that CVE just showed up now, why there are no details, why it says there is no fix, or how to correct it. I had nothing to do with the report.

Also, even the issue itself isn't actually an issue for users of the pgx driver itself. Bind messages are client emitted messages create by the driver. They are never received the a client. The only way Bind.Decode() would be triggered is if the pgproto3 package were being used directly to build a proxy that was parsing messages from a client.

[mrz1836]

Thanks @jackc!

I was also seeing it here:

[jackc]

Same thing. Already fixed and I don't have anything to do with why those showed up, why they are showing as unfixed, or how to get it corrected.

[einsibjarni]

This is a growing problem with CVE's. It got a lot of attention when curl became a CNA because they couldn't handle the amount of frivilous CVE's that got assigned to them.

Hopefully there is a channel for you to communicate this back to Mitre and ammend the CVE with the versions it was fixed in

[cardilloscreations]

I don't think this will add much to the discussion, but this just popped up in VSCode as well. Looks like the same issues, just reported in a different way, coming from govulncheck. This is against the latest release 5.9.1 as well.

---

github.com/jackc/pgx/v5
Note: The project imports packages with known vulnerabilities. Use govulncheck to check if the project uses vulnerable symbols.

GO-2026-4771 CVE-2026-33815 in github.com/jackc/pgx
github.com/jackc/pgx/v5/pgproto3 No fix is available.

GO-2026-4772 CVE-2026-33816 in github.com/jackc/pgx
github.com/jackc/pgx/v5/pgproto3 No fix is available.

[yunliaw]

related issue has been raised in golang's vulndb: golang/vulndb#4944, golang/vulndb#4943