GO-2026-6166

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-6166
Import Source
https://vuln.go.dev/ID/GO-2026-6166.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2026-6166
Aliases
  • CVE-2026-56868
Withdrawn
2026-08-18T20:22:36Z
Published
2026-08-18T16:38:10Z
Modified
2026-08-19T17:32:58.099398489Z
Summary
WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq
Details

(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS token and stores the provider, but it tracks neither whether a continuation occurred nor the provider's done result. The startup loop then accepts AuthenticationOk and completes the connection. The continuation branch also discards provider errors and can proceed after failed mutual authentication.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6166"
}
References

Affected packages

Go / github.com/lib/pq

Package

Name
github.com/lib/pq
View open source insights on deps.dev
Purl
pkg:golang/github.com/lib/pq

Affected ranges

Type
SEMVER
Events
Introduced
1.6.0

Ecosystem specific 

{
    "imports": [
        {
            "path": "github.com/lib/pq",
            "symbols": [
                "Connector.Connect",
                "DialOpen",
                "Driver.Open",
                "NewDialListener",
                "NewListener",
                "NewListenerConn",
                "Open"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-6166.json"