GO-2026-6170
- Source
- https://pkg.go.dev/vuln/GO-2026-6170
- Import Source
- https://vuln.go.dev/ID/GO-2026-6170.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6170
- Aliases
-
- CVE-2026-56871
- Withdrawn
- 2026-08-18T20:22:49Z
- Published
- 2026-08-18T16:38:10Z
- Modified
- 2026-08-18T21:30:14.145150636Z
- Summary
- WITHDRAWN: Malformed backend frame length causes panic in github.com/lib/pq
- Details
-
(This report has been withdrawn with reason: "False positive"). github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose length is zero through three produces a negative payload length. recvMessage then slices the connection scratch buffer with that negative bound, causing an unrecovered runtime panic that terminates the calling goroutine and process.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6170" }- References
Affected packages
Go / github.com/lib/pq
Package
- Name
- github.com/lib/pq
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/lib/pq
Ecosystem specific
{
"imports": [
{
"path": "github.com/lib/pq",
"symbols": [
"Connector.Connect",
"DialOpen",
"Driver.Open",
"NewDialListener",
"NewListener",
"NewListenerConn",
"Open",
"conn.Begin",
"conn.BeginTx",
"conn.Commit",
"conn.Exec",
"conn.ExecContext",
"conn.Ping",
"conn.Prepare",
"conn.PrepareContext",
"conn.Query",
"conn.QueryContext",
"conn.Rollback",
"conn.recvMessage",
"rows.Close",
"rows.Next",
"stmt.Close",
"stmt.Exec",
"stmt.ExecContext",
"stmt.Query",
"stmt.QueryContext"
]
}
]
}