GO-2026-6173
- Source
- https://pkg.go.dev/vuln/GO-2026-6173
- Import Source
- https://vuln.go.dev/ID/GO-2026-6173.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6173
- Aliases
-
- CVE-2026-56874
- Withdrawn
- 2026-08-18T20:23:02Z
- Published
- 2026-08-18T16:38:10Z
- Modified
- 2026-08-19T17:32:58Z
- Summary
- WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq
- Details
-
(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). The special-case parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls bufio.Reader.ReadString(0) without a byte limit. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send an error message response with non-NUL bytes continuously, causing the client to buffer an arbitrarily large string and crash with an unrecoverable out-of-memory error.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6173" }- References
Affected packages
Go / github.com/lib/pq
Package
- Name
- github.com/lib/pq
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/lib/pq
Ecosystem specific
{
"imports": [
{
"path": "github.com/lib/pq",
"symbols": [
"Connector.Connect",
"DialOpen",
"Driver.Open",
"NewDialListener",
"NewListener",
"NewListenerConn",
"Open",
"conn.Begin",
"conn.BeginTx",
"conn.Commit",
"conn.Exec",
"conn.ExecContext",
"conn.Ping",
"conn.Prepare",
"conn.PrepareContext",
"conn.Query",
"conn.QueryContext",
"conn.Rollback",
"conn.recvMessage",
"rows.Close",
"rows.Next",
"stmt.Close",
"stmt.Exec",
"stmt.ExecContext",
"stmt.Query",
"stmt.QueryContext"
]
}
]
}