Bug 2451847 (CVE-2026-32286)

Summary: CVE-2026-32286 github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abuckta, adudiak, agarcial, alcohan, aoconnor, aprice, asegurap, bdettelb, caswilli, ckandaga, cmah, crizzo, dfreiber, dkuc, doconnor, drow, gparvin, gtanzill, jaharrin, jbalunas, jburrell, jbuscemi, jdobes, jeder, jkoehler, jmitchel, jsamir, jsherril, jvasik, kaycoth, kgaikwad, kshier, lball, lgamliel, lphiri, mstipich, ngough, oezr, orabin, pahickey, pbohmill, pvasanth, rblanco, rexwhite, rfreiman, rhaigner, rochandr, stcannon, sthirugn, teagle, veshanka, vkarehfa, vkumar, vmugicag, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2452381, 2452382, 2452383, 2452384, 2452385, 2452386    
Bug Blocks:    

Description OSIDB Bzimport 2026-03-26 20:02:24 UTC 
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.