CVE-2024-27304

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.

• CWE-89
• CWE-190

• https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007Patch
• https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8Vendor Advisory
• https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4Patch
• https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8Patch
• https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81dfPatch
• https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghvVendor Advisory
• https://www.youtube.com/watch?v=Tfg1B8u1yvEPress/Media Coverage
• https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007Patch
• https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8Vendor Advisory
• https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4Patch
• https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8Patch
• https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81dfPatch
• https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghvVendor Advisory

Published

Mar 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27299phpMyFAQ is an open source FAQ web application for PHP 8.1+ …8.8
• CVE-2024-2730Mautic uses predictable page indices for unpublished landing…5.3
• CVE-2024-27300phpMyFAQ is an open source FAQ web application for PHP 8.1+ …5.4
• CVE-2024-27301Support App is an opensource application specialized in mana…7.3
• CVE-2024-27302go-zero is a web and rpc framework. Go-zero allows user to s…9.1
• CVE-2024-27303electron-builder is a solution to package and build a ready …7.3
• CVE-2024-27305aiosmtpd is a reimplementation of the Python stdlib smtpd.py…5.3
• CVE-2024-27306aiohttp is an asynchronous HTTP client/server framework for …6.1
• CVE-2024-27307JSONata is a JSON query and transformation language. Startin…9.8
• CVE-2024-27308Mio is a Metal I/O library for Rust. When using named pipes …9.1
• CVE-2024-27309While an Apache Kafka cluster is being migrated from ZooKeep…7.4
• CVE-2024-2731Users with low privileges (all permissions deselected in the…5.4