The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
The CVSS severity warrants an early asset and exposure review.
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Confirm exposure before applying a vendor-supported change.
Confirm that github.com/jackc/pgproto3/v2 github.com/jackc/pgproto3/v2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 and an affected version are present.
Combine exploitation signals with asset exposure and business criticality.
Follow the vendor advisory or supported update path and preserve rollback options.
Recheck the version, service health, access paths, and relevant logs.
