GO-2026-6172
- Source
- https://pkg.go.dev/vuln/GO-2026-6172
- Import Source
- https://vuln.go.dev/ID/GO-2026-6172.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6172
- Aliases
-
- CVE-2026-56873
- Withdrawn
- 2026-08-18T20:22:58Z
- Published
- 2026-08-18T16:38:10Z
- Modified
- 2026-08-19T17:30:29.979447037Z
- Summary
- WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq
- Details
-
(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active network attacker on an unauthenticated connection can send frame headers declaring multi-gigabyte or invalid-phase payloads, forcing large allocations that lead to memory exhaustion and runtime out-of-memory crashes.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6172" }- References
Affected packages
Go / github.com/lib/pq
Package
- Name
- github.com/lib/pq
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/lib/pq
Ecosystem specific
{
"imports": [
{
"path": "github.com/lib/pq",
"symbols": [
"Connector.Connect",
"DialOpen",
"Driver.Open",
"NewDialListener",
"NewListener",
"NewListenerConn",
"Open",
"conn.Begin",
"conn.BeginTx",
"conn.Commit",
"conn.Exec",
"conn.ExecContext",
"conn.Ping",
"conn.Prepare",
"conn.PrepareContext",
"conn.Query",
"conn.QueryContext",
"conn.Rollback",
"conn.recvMessage",
"conn.startup",
"rows.Close",
"rows.Next",
"stmt.Close",
"stmt.Exec",
"stmt.ExecContext",
"stmt.Query",
"stmt.QueryContext"
]
}
]
}