CVE-2026-33816 in github.com/jackc/pgx
Summary
| CVE | CVE-2026-33816 |
|---|---|
| State | PUBLISHED |
| Assigner | Go |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-07 16:16:24 UTC |
| Updated | 2026-07-20 12:18:45 UTC |
| Description | Memory-safety vulnerability in github.com/jackc/pgx/v5. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.005610000 probability, percentile 0.429960000 (date 2026-07-20)
Problem Types: NVD-CWE-noinfo | CWE-787 | CWE-697 — Incorrect Comparison | CWE-787 Out-of-bounds Write
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | CVSS | 8.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 8.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Github.comjackcpgxv5 | Github.com/jackc/pgx/v5/pgproto3 | affected 5.9.0 semver | Not specified |
| ADP | Red Hat | Cryostat 4 On RHEL 9 | unaffected 4.2.0-13 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:1.0.1-1.el10_2 * rpm | Not specified |
| ADP | Red Hat | RHEM 1.0 For RHEL 9 | unaffected 0:1.0.3-1.el9em * rpm | Not specified |
| ADP | Red Hat | RHEM 1.1 For RHEL 10 | unaffected 0:1.1.3-1.el10em * rpm | Not specified |
| ADP | Red Hat | RHEM 1.1 For RHEL 9 | unaffected 0:1.1.3-1.el9em * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1780101236 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1780101226 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1780101239 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler 2.19 | unaffected 1779953535 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.3.4 | unaffected 1779210675 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.3.4 | unaffected 1779210608 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.3.4 | unaffected 1779209992 * rpm | Not specified |
| ADP | Red Hat | Multicluster Global Hub 1.7.1 | unaffected 1779925273 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.15 | unaffected 1780677003 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1780926805 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1777307791 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1777307791 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.8 | unaffected 1777307791 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1777986630 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1777986630 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1777986630 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1777976489 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1777976489 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1777976489 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194638 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194353 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784196588 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784195620 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194309 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194653 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194144 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194980 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194347 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194971 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784128388 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784128860 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784126780 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784127787 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784126762 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784126774 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784127791 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784127135 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784126733 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784127775 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 1.0.1-0.1.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667125 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783666755 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784054598 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055387 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055726 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667517 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667577 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667611 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055020 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667641 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055586 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667790 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667859 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667875 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667869 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783667877 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055576 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055244 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1784055382 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668266 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783668288 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1783669219 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Pipelines 1.21 | unaffected 1780641574 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780048814 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1780053572 * rpm | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler Operator For Red Hat Openshift | Not specified | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler Operator For Red Hat Openshift | Not specified | Not specified |
| ADP | Red Hat | Custom Metric Autoscaler Operator For Red Hat Openshift | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | Multicluster Global Hub | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat Quay 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager - Tech Preview | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager - Tech Preview | Not specified | Not specified |
| ADP | Red Hat | Zero Trust Workload Identity Manager - Tech Preview | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:40118 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24503 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-33816 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:11217 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:40945 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24479 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:40984 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13791 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| pkg.go.dev/vuln/GO-2026-4772 | [email protected] | pkg.go.dev | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:25273 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13907 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:11070 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24482 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:13829 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:19137 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26636 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36796 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24539 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41019 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24475 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17789 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26519 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22423 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33816.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-04-07T16:01:14.142Z | Reported to Red Hat. |
| ADP | 2026-04-07T15:19:24.529Z | Made public. |
Solutions
ADP: RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9
ADP: RHSA-2026:17789: Cryostat 4 on RHEL 9
ADP: RHSA-2026:36796: RHEM 1.0 for RHEL 9
ADP: RHSA-2026:19137: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:26636: Custom Metric Autoscaler 2.19
ADP: RHSA-2026:22423: Multicluster Global Hub 1.3.4
ADP: RHSA-2026:24503: Multicluster Global Hub 1.7.0
ADP: RHSA-2026:24539: Red Hat Advanced Cluster Management for Kubernetes 2.15
ADP: RHSA-2026:25273: Red Hat Advanced Cluster Management for Kubernetes 2.16
ADP: RHSA-2026:11070: Red Hat Advanced Cluster Security 4.8
ADP: RHSA-2026:11217: Red Hat Advanced Cluster Security 4.8
ADP: RHSA-2026:13791: Red Hat Advanced Cluster Security 4.9
ADP: RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:40945: Red Hat Edge Manager 1.1
ADP: RHSA-2026:40118: Red Hat Edge Manager 1.1
ADP: RHSA-2026:13907: Red Hat Hardened Images
ADP: RHSA-2026:26519: Red Hat OpenShift Pipelines 1.21
ADP: RHSA-2026:40984: Red Hat Openshift Data Foundation 4.2
ADP: RHSA-2026:24479: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:24475: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:24482: Red Hat Trusted Artifact Signer 1.3
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.