CVE-2024-27304
pgx SQL Injection via Protocol Message Size Overflow
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
pgx SQL Injection via Protocol Message Size Overflow
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
CVE-2024-27304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89, CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2024-0972
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
EUVD-2024-0972- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7jwh-3vrq-q3m8
pgproto3 SQL Injection via Protocol Message Size Overflow
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.
Patches
The problem is resolved in v2.3.3
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
GHSA-7jwh-3vrq-q3m8- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89, CWE-190
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mrww-27vc-gghv
pgx SQL Injection via Protocol Message Size Overflow
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.
Patches
The problem is resolved in v4.18.2 and v5.5.4.
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
GHSA-mrww-27vc-gghv- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89, CWE-190
- Updated
- 2026-11-02
NVD
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
CVE-2024-27304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89, CWE-190
- Updated
- 2026-11-02
OSV
pgx SQL Injection via Protocol Message Size Overflow
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
CVE-2024-27304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-89
- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2024-27304
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
DEBIAN-CVE-2024-27304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-7jwh-3vrq-q3m8
pgproto3 SQL Injection via Protocol Message Size Overflow
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.
Patches
The problem is resolved in v2.3.3
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
GHSA-7jwh-3vrq-q3m8- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-89
- Updated
- 2026-11-02
OSVGHSA-mrww-27vc-gghv
pgx SQL Injection via Protocol Message Size Overflow
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.
Patches
The problem is resolved in v4.18.2 and v5.5.4.
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
GHSA-mrww-27vc-gghv- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-89
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-27304
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
UBUNTU-CVE-2024-27304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-35752 No score
CVE-2024-27304 affecting package telegraf for versions less than 1.31.0-1
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
AZL-35752- Updated
- 2026-11-02
OSVAZL-35762 No score
CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Record
AZL-35762- Updated
- 2026-11-02
OSVGO-2024-2606 No score
SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx
An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size.
- Record
GO-2024-2606- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/jackc/pgproto3Go |
before 2.3.3 | 2.3.3 |
github.com/jackc/pgproto3/v2Go |
before 2.3.3 | 2.3.3 |
github.com/jackc/pgxGo |
before 4.18.2 | 4.18.2 |
github.com/jackc/pgxGo |
5.0.0 up to 5.5.4 | 5.5.4 |
github.com/jackc/pgx/v4Go |
before 4.18.2 | 4.18.2 |
github.com/jackc/pgx/v5Go |
5.0.0 up to 5.5.4 | 5.5.4 |
telegrafAzure Linux:3 |
before 1.31.0-1 | 1.31.0-1 |
telegrafAzure Linux:2 |
before 1.28.5-5 | 1.28.5-5 |
golang-github-jackc-pgconnDebian:12 |
All versions, plus listed versions 1.11.0-21.14.0-11.14.3-11.14.3-1~exp0 |
None known |
golang-github-jackc-pgconnDebian:13 |
All versions, plus listed versions 1.14.0-11.14.3-11.14.3-1~exp0 |
None known |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
golang-github-jackc-pgconnDebian:14 |
before 1.14.3-1, plus listed versions 1.14.0-11.14.3-1~exp0 |
1.14.3-1 |
golang-github-jackc-pgxDebian:12 |
All versions, plus listed versions 4.15.0-44.18.1-14.18.1-24.18.3-14.18.3-1~exp04.18.3-2 |
None known |
golang-github-jackc-pgxDebian:13 |
before 4.18.1-2 | 4.18.1-2 |
golang-github-jackc-pgxDebian:14 |
before 4.18.1-2 | 4.18.1-2 |
github.com/jackc/pgxGo |
All versions | None known |
golang-github-jackc-pgxUbuntu:22.04:LTS |
All versions, plus listed versions 3.6.2-2 |
None known |
golang-github-jackc-pgproto3Ubuntu:24.04:LTS |
All versions, plus listed versions 2.2.0-22.3.2-1 |
None known |
golang-github-jackc-pgxUbuntu:24.04:LTS |
All versions, plus listed versions 4.15.0-44.18.1-1 |
None known |
golang-github-jackc-pgproto3Ubuntu:25.10 |
All versions, plus listed versions 2.3.2-1 |
None known |
golang-github-jackc-pgxUbuntu:25.10 |
All versions, plus listed versions 4.18.1-14.18.1-2 |
None known |
golang-github-jackc-pgproto3Ubuntu:26.10 |
All versions, plus listed versions 2.3.2-12.3.3-2 |
None known |
golang-github-jackc-pgxUbuntu:26.10 |
All versions, plus listed versions 4.18.1-24.18.3-2 |
None known |
golang-github-jackc-pgproto3Ubuntu:26.04:LTS |
All versions, plus listed versions 2.3.2-1 |
None known |
golang-github-jackc-pgxUbuntu:26.04:LTS |
All versions, plus listed versions 4.18.1-2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | roaris/CVE-2024-27304-PoC | 2025-10-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-27304 is a critical vulnerability (CVSS 9.8) in Jackc Pgx, published March 4, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in github.com/jackc/pgproto3 2.3.3.
References
github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv
Show 10 moreShow less
youtube.com/watch?v=Tfg1B8u1yvE
nvd.nist.gov/vuln/detail/CVE-2024-27304
security-tracker.debian.org/tracker/CVE-2024-27304
ubuntu.com/security/CVE-2024-27304
cve.org/CVERecord?id=CVE-2024-27304