CVE-2026-33816 CVE-2026-33816 in github.com/jackc/pgx

Critical 9.8 Published 7 Apr 2026 Updated 11 Sep 2026

A memory-safety vulnerability in the pgx Go driver allows attackers to potentially execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33816?

CVE-2026-33816 is a critical memory corruption vulnerability in github.com/jackc/pgx/v5/pgproto3, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Weakness: CWE-787

Which versions are affected by CVE-2026-33816?

3 open source packages ship an affected version, including github.com/jackc/pgx/v5. It affects 1 product.

Package	Affected	Fixed in
`github.com/jackc/pgx/v5` Go	All versions	`5.9.0`
`github.com/jackc/pgx/v5` Go	All versions	`5.9.0`
`github.com/jackc/pgx/v5` Go	All versions	`5.9.0`

Linux distribution packages (5)

`go-fdo-server` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.1.hum1`
`go-fdo-server-manufacturer` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.1.hum1`
`go-fdo-server-owner` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.1.hum1`
`go-fdo-server-rendezvous` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.1.hum1`
`kubectl-cnpg` openSUSE:Tumbleweed	All versions	`1.29.1-1.1`

Products include Jackc Pgx.

How do I fix CVE-2026-33816?

Upgrade github.com/jackc/pgx/v5 to 5.9.0 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-33816 being exploited?

There is no known exploitation of CVE-2026-33816 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-CP86955, CLEANSTART-2026-MC70184, CLEANSTART-2026-SD27906, CLEANSTART-2026-VF40617, DEBIAN-CVE-2026-33816, GHSA-9jj7-4m8r-rfcm and 120 more.