CVE-2026-33815 in github.com/jackc/pgx
Summary
| CVE | CVE-2026-33815 |
|---|---|
| State | PUBLISHED |
| Assigner | Go |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-07 16:16:24 UTC |
| Updated | 2026-07-21 12:18:11 UTC |
| Description | Memory-safety vulnerability in github.com/jackc/pgx/v5. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.006050000 probability, percentile 0.450850000 (date 2026-07-21)
Problem Types: NVD-CWE-noinfo | CWE-787 | CWE-129 — Improper Validation of Array Index | CWE-787 Out-of-bounds Write
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | CVSS | 8.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 8.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Github.comjackcpgxv5 | Github.com/jackc/pgx/v5/pgproto3 | affected 5.9.0 semver | Not specified |
| ADP | Red Hat | Cryostat 4 On RHEL 9 | unaffected 4.2.0-13 * rpm | Not specified |
| ADP | Red Hat | RHEM 1.0 For RHEL 9 | unaffected 0:1.0.3-1.el9em * rpm | Not specified |
| ADP | Red Hat | RHEM 1.1 For RHEL 10 | unaffected 0:1.1.3-1.el10em * rpm | Not specified |
| ADP | Red Hat | RHEM 1.1 For RHEL 9 | unaffected 0:1.1.3-1.el9em * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1780101236 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1780101226 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1780101239 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1779953535 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.3.4 | unaffected 1779210675 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.3.4 | unaffected 1779210608 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.3.4 | unaffected 1779209992 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.7.0 | unaffected 1779925273 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.15 | unaffected 1780677003 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1780926805 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1777307791 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1777307791 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1777307791 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1777986630 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1777986630 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1777986630 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1777976489 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1777976489 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1777976489 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667125 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783666755 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784054598 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055387 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055726 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667517 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667577 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667611 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055020 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667641 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055586 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667790 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667859 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667875 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667869 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667877 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055576 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055244 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055382 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668266 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668288 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783669219 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780048814 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler Operator For Red Hat Openshift | Not specified | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler Operator For Red Hat Openshift | Not specified | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler Operator For Red Hat Openshift | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager - Tech Preview | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager - Tech Preview | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager - Tech Preview | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:24503 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33815.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| pkg.go.dev/vuln/GO-2026-4771 | [email protected] | pkg.go.dev | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:11217 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24479 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:40984 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13791 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:25273 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:11070 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24482 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13829 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-33815 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26636 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36796 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24539 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41019 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24475 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17789 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22423 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-04-07T16:01:25.130Z | Reported to Red Hat. |
| ADP | 2026-04-07T15:19:24.344Z | Made public. |
Solutions
ADP: RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9
ADP: RHSA-2026:17789: Cryostat 4 on RHEL 9
ADP: RHSA-2026:36796: RHEM 1.0 for RHEL 9
ADP: RHSA-2026:26636: Custom Metric Autoscaler 2.19
ADP: RHSA-2026:22423: Multicluster Global Hub 1.3.4
ADP: RHSA-2026:24503: Multicluster Global Hub 1.7.0
ADP: RHSA-2026:24539: Red Hat Advanced Cluster Management for Kubernetes 2.15
ADP: RHSA-2026:25273: Red Hat Advanced Cluster Management for Kubernetes 2.16
ADP: RHSA-2026:11070: Red Hat Advanced Cluster Security 4.8
ADP: RHSA-2026:11217: Red Hat Advanced Cluster Security 4.8
ADP: RHSA-2026:13791: Red Hat Advanced Cluster Security 4.9
ADP: RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:40984: Red Hat Openshift Data Foundation 4.2
ADP: RHSA-2026:24479: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:24475: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:24482: Red Hat Trusted Artifact Signer 1.3
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.