CVE-2024-27304 pgx SQL Injection via Protocol Message Size Overflow
An integer overflow in the pgx Go driver allows attackers to inject SQL by sending oversized messages, potentially leading to unauthorized database access or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27304?
CVE-2024-27304 is a critical SQL injection vulnerability in jackc pgx, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Which versions are affected by CVE-2024-27304?
16 open source packages ship an affected version, including github.com/jackc/pgx, github.com/jackc/pgproto3 and github.com/jackc/pgproto3/v2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jackc/pgx Go | All versions | None |
github.com/jackc/pgx Go | All versions | 4.18.2 |
github.com/jackc/pgx Go | All versions | 4.18.2 |
github.com/jackc/pgx Go | From 5.0.0 | 5.5.4 |
github.com/jackc/pgx Go | From 5.0.0 | 5.5.4 |
github.com/jackc/pgproto3 Go | All versions | 2.3.3 |
10 more packages
github.com/jackc/pgproto3 Go | All versions | 2.3.3 |
github.com/jackc/pgproto3/v2 Go | All versions | 2.3.3 |
github.com/jackc/pgproto3/v2 Go | All versions | 2.3.3 |
github.com/jackc/pgproto3/v2 Go | All versions | 2.3.3 |
github.com/jackc/pgx/v4 Go | All versions | 4.18.2 |
github.com/jackc/pgx/v4 Go | All versions | 4.18.2 |
github.com/jackc/pgx/v4 Go | All versions | 4.18.2 |
github.com/jackc/pgx/v5 Go | From 5.0.0 | 5.5.4 |
github.com/jackc/pgx/v5 Go | From 5.0.0 | 5.5.4 |
github.com/jackc/pgx/v5 Go | From 5.0.0 | 5.5.4 |
Products include Jackc Pgproto3, Jackc Pgx.
How do I fix CVE-2024-27304?
Upgrade github.com/jackc/pgx to a fixed version for your release line: 4.18.2 or 5.5.4.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-27304 being exploited?
There is no known exploitation of CVE-2024-27304 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in jackc pgx
Sources
Also known as AZL-35752, AZL-35762, CLEANSTART-2026-LT14460, CLEANSTART-2026-VJ98970, DEBIAN-CVE-2024-27304, GHSA-7jwh-3vrq-q3m8 and 3 more.