CVE-2026-32286: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-32286 is a denial-of-service vulnerability in the github.com/jackc/pgproto3/v2 Go library, caused by improper validation of array indices in the DataRow.Decode function. A malicious or compromised PostgreSQL server can send a crafted DataRow message containing a negative field length value, triggering a slice bounds out of range panic that crashes the client application. The vulnerability affects all versions from 2.0.0 through 2.3.3 of the pgproto3/v2 package. It was reported on February 19, 2026, published to the GitHub Advisory Database on March 18, 2026, and assigned CVE-2026-32286 on March 26, 2026. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-129 (Improper Validation of Array Index). In data_row.go at lines 48–59, the field length is read as a signed int32 via msgSize := int(int32(binary.BigEndian.Uint32(src[rp:]))). While the null sentinel value of -1 is correctly handled, the subsequent bounds check if len(src[rp:]) < msgSize is vacuously false for any other negative value, because Go's len() always returns a non-negative integer. This allows execution to reach the slice expression dst.Values[i] = src[rp : rp+msgSize : rp+msgSize], which panics unconditionally when msgSize is negative. Approximately 2 billion negative int32 values (−2 through −2,147,483,648) are unguarded, and any server the client connects to can trigger this without requiring special privileges (GitHub Issue #2507, golang/vulndb #4518). The proposed fix is to add a msgSize < 0 guard between the null check and the bounds check.

Successful exploitation causes an unconditional process crash (panic) in any Go application using the affected pgproto3/v2 library when communicating with a malicious or compromised PostgreSQL server. The impact is limited to availability — there is no confidentiality or integrity impact. Any service relying on this library for database connectivity could be rendered unavailable, potentially affecting dependent business processes or cascading to downstream service failures (GitHub Advisory, GitHub Issue #2507).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-32286. The EPSS score is approximately 0.017% (Feedly data) to 0.072% (GitHub Advisory), placing it in a low exploitation probability range. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or compromise the PostgreSQL server that the vulnerable Go application connects to, which limits the attack surface to scenarios involving server-side compromise or man-in-the-middle positioning (GitHub Advisory, Feedly).

1. Gain server control: Compromise or control a PostgreSQL server (or act as a man-in-the-middle) that a target Go application using pgproto3/v2 (versions 2.0.0–2.3.3) connects to.
2. Craft a malicious DataRow message: Construct a PostgreSQL wire protocol DataRow message where one or more field length values are set to a negative int32 value (any value in the uint32 range 0x80000000–0xFFFFFFFE, excluding 0xFFFFFFFF which is the null sentinel -1).
3. Send the crafted message: Deliver the malicious DataRow message to the connecting Go client in response to any query that returns rows.
4. Trigger the panic: The DataRow.Decode function bypasses the bounds check (since len(...) < negativeValue is always false in Go) and executes src[rp : rp+msgSize : rp+msgSize] with a negative msgSize, causing an immediate runtime panic and crashing the Go application process (GitHub Issue #2507, golang/vulndb #4518).

• Logs: Go application crash logs or stderr output containing runtime error: slice bounds out of range with a negative index (e.g., [:-13619152]) originating from data_row.go in the pgproto3/v2 package.
• Process: Unexpected termination of Go services that use PostgreSQL connectivity via pgproto3/v2; repeated process restarts by supervisors (e.g., systemd, Kubernetes) following database query execution.
• Network: Anomalous PostgreSQL wire protocol traffic where DataRow messages contain field length bytes in the range 0x80000000–0xFFFFFFFE (excluding 0xFFFFFFFF); unexpected or unauthorized PostgreSQL server endpoints in connection logs.

As of the initial disclosure, no patched version of github.com/jackc/pgproto3/v2 had been released (all versions 2.0.0–2.3.3 are affected). IBM has released patches for affected products: IBM Guardium Data Security Center (advisory published May 12, 2026) and IBM Security QRadar EDR (advisory published June 2, 2026) (IBM Guardium Advisory, IBM QRadar Advisory). Red Hat has also issued errata (RHSA-2026:22450 and RHSA-2026:22714). As a workaround, ensure Go applications only connect to trusted, verified PostgreSQL servers and use TLS mutual authentication to prevent connection to rogue servers. Monitor the upstream pgproto3 repository and Go vulnerability database (pkg.go.dev/vuln/GO-2026-4518) for an official patch release (Go Vuln DB).

The vulnerability was discovered and reported by researcher athuljayaramop on February 19, 2026, with a detailed technical write-up referenced at securityinfinity.com. The Go vulnerability database team tracked it under GO-2026-4518, and the issue was acknowledged as a direct external report in the golang/vulndb repository. SUSE issued security advisories for affected packages, and the issue received coverage in Linux security news outlets (golang/vulndb #4518, GitHub Advisory).