Skip to content
Fencer Vulns
critical 9.8

CVE-2026-33816 json

CVE-2026-33816 in github.com/jackc/pgx

published 2026-04-07 7 mo ago modified 2026-10-26 13 d ago also GHSA-9jj7-4m8r-rfcm , GO-2026-4772 , EUVD-2026-19709

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Patch / fix

  • go github.com/jackc/pgx/v5 5.9.0
  • github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3 5.9.0
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-13
  • Red Hat Red Hat Enterprise Linux 10 0:1.0.1-1.el10_2
  • Red Hat RHEM 1.0 for RHEL 9 0:1.0.3-1.el9em
  • Red Hat RHEM 1.1 for RHEL 10 0:1.1.3-1.el10em
  • Red Hat RHEM 1.1 for RHEL 9 0:1.1.3-1.el9em
  • Red Hat Custom Metric Autoscaler 2.19 1779953535, 1780101226, 1780101236, 1780101239, 1788290121, 1788290333, 1788290523, 1788290620, 1788361753, 1788361758, 1788361799, 1788363289
  • Red Hat Multicluster Global Hub 1.3.4 1779209992, 1779210608, 1779210675
  • Red Hat Multicluster Global Hub 1.7.0 1779925273
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1780677003
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 1780926805
  • Red Hat Red Hat Advanced Cluster Security 4.8 1777307791
  • Red Hat Red Hat Advanced Cluster Security 4.9 1777986630
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 1777976489
  • Red Hat Red Hat Edge Manager 1.1 1784126733, 1784126762, 1784126774, 1784126780, 1784127135, 1784127775, 1784127787, 1784127791, 1784128388, 1784128860, 1784194144, 1784194309, 1784194347, 1784194353, 1784194638, 1784194653, 1784194971, 1784194980, 1784195620, 1784196588
  • Red Hat Red Hat Hardened Images 1.0.1-0.1.hum1
  • Red Hat Red Hat Openshift Data Foundation 4.20 1783666755, 1783667125, 1783667517, 1783667577, 1783667611, 1783667641, 1783667790, 1783667859, 1783667869, 1783667875, 1783667877, 1783668266, 1784054598, 1784055020, 1784055244, 1784055382, 1784055387, 1784055576, 1784055586, 1784055726
  • Red Hat Red Hat OpenShift Pipelines 1.21 1780641574
  • Red Hat Red Hat Trusted Artifact Signer 1.3 1780048814, 1780053572
  • golang-github-jackc-pgx-v5 Debian 14 5.9.2-1

debian advisories DEBIAN-CVE-2026-33816

  • flightctl edge manager 1.1 1.1.3-1.el10em
  • flightctl edge manager 1.1 1.1.3-1.el9em
  • flightctl-cli edge manager 1.1 1.1.3-1.el10em
  • flightctl-cli edge manager 1.1 1.1.3-1.el9em
  • flightctl-agent edge manager 1.1 1.1.3-1.el10em
  • flightctl-agent edge manager 1.1 1.1.3-1.el9em
  • flightctl edge manager 1.0 1.0.3-1.el9em
  • flightctl-cli edge manager 1.0 1.0.3-1.el9em

red hat advisories RHSA-2026:41019RHSA-2026:36796RHSA-2026:19137RHSA-2026:13907

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • kubectl-cnpg openSUSE Tumbleweed 1.29.1-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:10754-1

  • go-fdo-server AlmaLinux 10 1.0.1-1.el10_2
  • go-fdo-server-owner AlmaLinux 10 1.0.1-1.el10_2
  • go-fdo-server-rendezvous AlmaLinux 10 1.0.1-1.el10_2
  • go-fdo-server-manufacturer AlmaLinux 10 1.0.1-1.el10_2

almalinux advisories ALSA-2026:19137

  • go-fdo-server Rocky Linux 10 1.0.1-1.el10_2

rocky linux advisories RLSA-2026:19137

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33816 updated cvss 8.3

github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability

  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift redhat-user-workloads/cma-podauto-tenant/custom-metrics-autoscaler-operator/keda-operator Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-9-rhel9, redhat-user-workloads/crt-redhat-acm-tenant/azure-service-operator-mce-211 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel8, multicluster-globalhub/multicluster-globalhub-manager-rhel8, multicluster-globalhub/multicluster-globalhub-rhel8-operator, multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9, redhat-user-workloads/acm-multicluster-glo-tenant/multicluster-global-hub-agent-globalhub-1-4, redhat-user-workloads/acm-multicluster-glo-tenant/multicluster-global-hub-agent-globalhub-1-5, +10 more Red Hat OpenShift Pipelines openshift-pipelines/pipelines-results-retention-policy-agent-rhel9
    affected: workaround, no fix available
  • Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel9-operator, 3scale-amp2/3scale-operator-bundle
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 4 rhacs-eng/release-main, rhacs-eng/release-roxctl, rhacs-eng/release-scanner-v4 Red Hat Edge Manager 1 redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-api, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-worker, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-db-setup, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-periodic, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-pam-issuer, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-cli-artifacts, +4 more Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel9 Red Hat Openshift Data Foundation 4 rhceph-dev/odf4-odf-cloudnative-pg-rhel9-operator Red Hat Trusted Artifact Signer securesign/trillian-database, securesign/trillian-logserver, securesign/trillian-logsigner, securesign/trillian-createtree, securesign/trillian-updatetree, securesign/certificate-transparency-go
    affected: workaround, no fix available
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview redhat-user-workloads/zero-trust-workload-tenant/spiffe-spire-agent-1-12-4/spiffe-spire-agent-1-12-4, redhat-user-workloads/zero-trust-workload-tenant/spiffe-spire-server-1-12-4/spiffe-spire-server-1-12-4, redhat-user-workloads/zero-trust-workload-tenant/spiffe-spire-oidc-discovery-provider-1-12-4/spiffe-spire-oidc-discovery
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-storage-rhel9 4.2.0-13
    fixed: vendor fix RHSA-2026:17789
  • Red Hat Custom Metric Autoscaler 2.19 custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 1780101239, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 1788361799, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 1780101236, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 1788361753, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator 1779953535, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator 1788290121, +6 more
    fixed: vendor fix RHSA-2026:26636
  • Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779210675, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779210608, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779209992
    fixed: vendor fix RHSA-2026:22423
  • Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779925273
    fixed: vendor fix RHSA-2026:24503
show 18 more
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/acm-grafana-rhel9 1790183254
    fixed: vendor fix RHSA-2026:72881
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/acm-grafana-rhel9 1780677003
    fixed: vendor fix RHSA-2026:24539
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/acm-grafana-rhel9 1780926805
    fixed: vendor fix RHSA-2026:25273
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1777307791
    fixed: vendor fix RHSA-2026:11070
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1777986630
    fixed: vendor fix RHSA-2026:13791
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security 1777976489
    fixed: vendor fix RHSA-2026:13829
  • Red Hat Edge Manager 1.1 rhem/flightctl-api-rhel9 1784126780, rhem/flightctl-api-rhel10 1784196588, rhem/flightctl-worker-rhel9 1784127775, rhem/flightctl-worker-rhel10 1784194971, rhem/flightctl-db-setup-rhel9 1784126762, rhem/flightctl-periodic-rhel9 1784127791, +14 more
    fixed: vendor fix RHSA-2026:40945
  • Red Hat Enterprise Linux AppStream (v. 10) go-fdo-server 1.0.1-1.el10_2, go-fdo-server-owner 1.0.1-1.el10_2, go-fdo-server-rendezvous 1.0.1-1.el10_2, go-fdo-server-manufacturer 1.0.1-1.el10_2
    fixed: vendor fix RHSA-2026:19137
  • Red Hat Hardened Images go-fdo-server 1.0.1-0.1.hum1, go-fdo-server-owner 1.0.1-0.1.hum1, go-fdo-server-rendezvous 1.0.1-0.1.hum1, go-fdo-server-manufacturer 1.0.1-0.1.hum1
    fixed: vendor fix RHSA-2026:13907
  • Red Hat OpenShift AI 3.3 rhoai/odh-ml-pipelines-driver-rhel9 1790128730, rhoai/odh-ml-pipelines-launcher-rhel9 1790128683, rhoai/odh-ml-pipelines-api-server-v2-rhel9 1790129051, rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9 1790130666, rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9 1790128656
    fixed: vendor fix RHSA-2026:73987
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1783667125, odf4/odf-cli-rhel9 1784055020, odf4/mcg-core-rhel9 1784054598, odf4/odf-console-rhel9 1784055586, odf4/mcg-rhel9-operator 1784055387, odf4/ocs-rhel9-operator 1783667611, +16 more
    fixed: vendor fix RHSA-2026:40984
  • Red Hat OpenShift Pipelines 1.21 openshift-pipelines/pipelines-results-api-rhel9 1780641574
    fixed: vendor fix RHSA-2026:26519
  • Red Hat Trusted Artifact Signer 1.3 rhtas/createtree-rhel9 1780053572, rhtas/updatetree-rhel9 1780053572, rhtas/trillian-database-rhel9 1780053572, rhtas/trillian-logserver-rhel9 1780053572, rhtas/trillian-logsigner-rhel9 1780053572, rhtas/certificate-transparency-rhel9 1780048814
    fixed: vendor fix RHSA-2026:24479
  • Red Hat RHEM 1.0 for RHEL 9 flightctl 1.0.3-1.el9em, flightctl-cli 1.0.3-1.el9em, flightctl-agent 1.0.3-1.el9em, flightctl-selinux 1.0.3-1.el9em
    fixed: vendor fix RHSA-2026:36796
  • Red Hat RHEM 1.1 for RHEL 9 flightctl 1.1.3-1.el9em, flightctl-cli 1.1.3-1.el9em, flightctl-agent 1.1.3-1.el9em Red Hat RHEM 1.1 for RHEL 10 flightctl 1.1.3-1.el10em, flightctl-cli 1.1.3-1.el10em, flightctl-agent 1.1.3-1.el10em
    fixed: vendor fix RHSA-2026:41019
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-9, cryostat/cryostat-db-rhel9 4.2.0-13, cryostat/jfr-datasource-rhel9 4.2.0-9, cryostat/cryostat-reports-rhel9 4.2.0-9, cryostat/cryostat-operator-bundle 4.2.0-7, cryostat/cryostat-rhel9-operator 4.2.0-13, +3 more Red Hat Custom Metric Autoscaler 2.19 custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle 1780104005, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9 1780088006, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9 1780088020, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9 1780088012
    not affected: vulnerable code not present
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift redhat-user-workloads/cma-podauto-tenant/custom-metrics-autoscaler-operator/keda-adapter, redhat-user-workloads/cma-podauto-tenant/custom-metrics-autoscaler-operator/keda-webhooks, redhat-user-workloads/cma-podauto-tenant/custom-metrics-autoscaler-operator/custom-metrics-autoscaler-operator Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-operator-bundle
    not affected: component not present
  • Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779212259, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779925031, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779924243 Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780361828, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780615638, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887500, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780616828, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779815431 Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/thanos-rhel9 1790185128, rhacm2/acm-cli-rhel9 1790181117, rhacm2/console-rhel9 1790181939, rhacm2/prometheus-rhel9 1790181195, rhacm2/acm-search-v2-rhel9 1790184752, rhacm2/node-exporter-rhel9 1790182238, +37 more Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/thanos-rhel9 1780908155, rhacm2/acm-cli-rhel9 1780415683, rhacm2/console-rhel9 1780876734, rhacm2/prometheus-rhel9 1780906025, rhacm2/acm-search-v2-rhel9 1780877544, rhacm2/node-exporter-rhel9 1780876985, +39 more Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/thanos-rhel9 1780931547, rhacm2/acm-cli-rhel9 1781100469, rhacm2/console-rhel9 1780600823, rhacm2/prometheus-rhel9 1780931508, rhacm2/acm-search-v2-rhel9 1780066324, rhacm2/node-exporter-rhel9 1780877735, +40 more
    not affected: vulnerable code not present

16 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/jackc/pgx/v5
<5.9.0
5.9.0

Affected products

  • github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat RHEM 1.0 for RHEL 9
  • Red Hat RHEM 1.1 for RHEL 10
  • Red Hat RHEM 1.1 for RHEL 9
  • Red Hat Custom Metric Autoscaler 2.19
  • Red Hat Multicluster Global Hub 1.3.4
  • Red Hat Multicluster Global Hub 1.7.0
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Red Hat Advanced Cluster Security 4.8
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
  • Red Hat Red Hat Edge Manager 1.1
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat OpenShift Pipelines 1.21
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Multicluster Global Hub
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Edge Manager 1
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Quay 3
  • Red Hat Red Hat Trusted Artifact Signer
  • Red Hat Zero Trust Workload Identity Manager
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.