PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33816 github.com/jackc/pgx/v5 CVE debrief

CVE-2026-33816 is a critical memory-safety vulnerability in github.com/jackc/pgx/v5. NVD rates it 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a remotely reachable issue with severe confidentiality, integrity, and availability impact. The NVD record and the linked Go advisory point to affected pgx/v5 versions before 5.9.0.

Vendor
github.com/jackc/pgx/v5
Product
github.com/jackc/pgx/v5/pgproto3
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-08-24
Advisory published
2026-04-07
Advisory updated
2026-08-24

Who should care

Organizations and developers using github.com/jackc/pgx/v5 in applications, services, or dependencies should treat this as urgent, especially if the deployed version is earlier than 5.9.0.

Technical summary

NVD classifies CVE-2026-33816 as a memory-safety vulnerability in jackc/pgx/v5 and marks versions before 5.9.0 as vulnerable. The published CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) suggests the issue can be triggered over the network without privileges or user interaction and can have severe impact. NVD does not provide a more specific CWE in the supplied record, so the exact failure mode should be taken from vendor guidance and release notes.

Defensive priority

Immediate. A remotely exploitable memory-safety issue with a critical CVSS score should be prioritized for rapid patching and dependency verification.

Recommended defensive actions

  • Upgrade github.com/jackc/pgx/v5 to version 5.9.0 or later, or to the first fixed release identified by the Go advisory.
  • Inventory applications, services, and transitive dependencies that import pgx/v5 and confirm the runtime version in use.
  • Review lockfiles, vendored code, and build pipelines to ensure the fixed version is actually deployed everywhere.
  • Monitor the linked Go advisory and NVD record for any additional remediation guidance or clarifications.
  • If immediate upgrade is not possible, accelerate change windows and reduce exposure of affected systems until patched.

Evidence notes

The NVD record published on 2026-04-07 and modified on 2026-05-21 identifies CVE-2026-33816 as affecting cpe:2.3:a:jackc:pgx:*:*:*:*:*:go:*:* with versionEndExcluding 5.9.0. The same record links to the Go vulnerability notice GO-2026-4772 as a third-party advisory. NVD assigns CVSS 9.8 with a network-exploitable, no-auth, no-interaction vector. No more specific weakness description is provided in the supplied NVD data beyond memory-safety.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33816 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33816

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33816 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33816

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.