CVE-2026-4427: 
Wolfi vulnerability analysis and mitigation

CVE-2026-4427 is a Denial of Service vulnerability in github.com/jackc/pgproto3 (v2), a Go library implementing the PostgreSQL wire protocol. The flaw exists in the DataRow.Decode function, which fails to properly validate negative field lengths sent in DataRow messages by a malicious or compromised PostgreSQL server, causing a slice bounds out of range panic. It was reported on February 19, 2026, published on March 18, 2026, and subsequently determined to be a duplicate of CVE-2026-32286. Affected versions include github.com/jackc/pgproto3/v2 from 2.0.0 onward (used with pgx v4). It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-129 (Improper Validation of Array Index). In data_row.go, the field length is read as a signed int32 via msgSize := int(int32(binary.BigEndian.Uint32(src[rp:]))). The null sentinel value -1 is handled correctly, but the subsequent bounds check if len(src[rp:]) < msgSize is vacuously false for any other negative value, since Go's len() always returns a non-negative integer. Execution then reaches dst.Values[i] = src[rp : rp+msgSize : rp+msgSize], which panics unconditionally with a runtime slice bounds out of range error. Any uint32 value in the range 0x80000000–0xFFFFFFFE (approximately 2 billion negative int32 values) can trigger this crash. The fix requires adding a msgSize < 0 guard between the null check and the bounds check (Go VulnDB Issue, pgx Issue).

Successful exploitation causes an unconditional process crash (panic) in any Go application using github.com/jackc/pgproto3/v2, resulting in a complete loss of availability for the affected service. Since no privileges are required and the attack can be launched over the network by any PostgreSQL server the client connects to — including a malicious or compromised one — the impact extends to all dependent systems and services relying on the affected Go application. There is no confidentiality or integrity impact; the vulnerability is purely a Denial of Service (Red Hat Bugzilla, pgx Issue).

The vulnerability requires no authentication, no user interaction, and no special privileges — a malicious or compromised PostgreSQL server can trigger the crash by sending a single crafted DataRow message. No public exploit code or exploit kit has been identified, and there is no evidence of in-the-wild exploitation. The CVE has been rejected as a duplicate of CVE-2026-32286. The EPSS score is approximately 0.065% (very low probability of exploitation in the near term). It is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Bugzilla, Feedly).

1. Set up a malicious PostgreSQL server: Deploy or compromise a PostgreSQL server (or implement a fake server using a library like pgproto3 itself) that the target Go application will connect to.
2. Establish a connection: Wait for or induce the target Go application to connect to the malicious server and issue a query that will return results (triggering a DataRow response).
3. Craft a malicious DataRow message: Construct a DataRow wire protocol message where one or more field lengths are set to a negative int32 value (any uint32 in the range 0x80000000–0xFFFFFFFE, e.g., 0x80000001 which decodes as -2147483647).
4. Send the crafted message: Transmit the malicious DataRow message to the connecting client as part of the query response.
5. Trigger the panic: The DataRow.Decode function in the client's pgproto3/v2 library bypasses the bounds check and attempts the invalid slice operation, causing an immediate runtime panic and crashing the Go application process (pgx Issue, Go VulnDB Issue).

• Logs: Go application logs or system logs showing a runtime panic with message panic: runtime error: slice bounds out of range originating from data_row.go in the github.com/jackc/pgproto3/v2 package.
• Process: Unexpected termination of Go application processes that use pgproto3/v2 for PostgreSQL connectivity, particularly following database query execution.
• Network: Connections from the Go application to unexpected or unauthorized PostgreSQL servers; unusual DataRow messages with field length bytes in the range 0x80000000–0xFFFFFFFE in network captures on the PostgreSQL wire protocol port (default TCP 5432).

Red Hat has addressed this issue for Red Hat Enterprise Linux 10 via RHSA-2026:22450 and for RHEL 9 via RHSA-2026:22714. Since CVE-2026-4427 is a duplicate of CVE-2026-32286, users should track and apply fixes under the canonical CVE-2026-32286. The upstream jackc/pgproto3 repository has been archived (end-of-life July 1, 2025); users of pgx v5 should migrate to the integrated pgproto3 within github.com/jackc/pgx. As a workaround, restrict Go applications to connecting only to trusted, verified PostgreSQL servers to eliminate the attack surface (Red Hat Bugzilla, pgproto3 Repo).

The vulnerability was originally reported by researcher athuljayaram on February 19, 2026, with a detailed technical write-up referencing a prior fix in a downstream consumer that was never backported to the upstream library. The Go vulnerability database team tracked it as a potential Go vulnerability under issue #4518. Social media activity was limited, with brief mentions on Bluesky and Mastodon. The CVE was subsequently rejected as a duplicate of CVE-2026-32286 (Go VulnDB Issue, Red Hat Bugzilla).