PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33815 github.com/jackc/pgx/v5 CVE debrief

CVE-2026-33815 is a critical memory-safety vulnerability in github.com/jackc/pgx/v5. The official NVD record rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which means it can have severe impact if exposed in production. The supplied official sources also point to the Go vulnerability advisory GO-2026-4771 for remediation guidance. No additional root-cause detail or fixed-version information was included in the supplied corpus.

Vendor
github.com/jackc/pgx/v5
Product
github.com/jackc/pgx/v5/pgproto3
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-09-10
Advisory published
2026-04-07
Advisory updated
2026-09-10

Who should care

Teams that use github.com/jackc/pgx/v5 in production Go applications, especially owners of internet-facing services and dependency managers responsible for Go module updates.

Technical summary

The supplied record identifies a memory-safety issue in github.com/jackc/pgx/v5. NVD marks the CVE as analyzed and assigns CVSS 3.1 9.8 with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impact. The NVD record references the Go security advisory GO-2026-4771, but the supplied corpus does not include an affected-version range, root cause specifics, or a published fixed version.

Defensive priority

Immediate (critical)

Recommended defensive actions

  • Inventory services, builds, and container images that depend on github.com/jackc/pgx/v5.
  • Review the official Go advisory GO-2026-4771 and the NVD entry for any fixed-version or mitigation guidance.
  • Prioritize dependency updates or patching as soon as a vendor-recommended remediation is available.
  • Rebuild, retest, and redeploy affected applications after updating the dependency.
  • Temporarily reduce exposure of affected services and increase monitoring for abnormal behavior until remediation is complete.

Evidence notes

This debrief is based only on the supplied official CVE/NVD records and the linked Go advisory. The corpus confirms the product family, critical severity, and CVSS vector, but it does not provide a detailed root cause, exploit scenario, or fixed version.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33815 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33815

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33815 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33815

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.