CVE-2026-32286

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS <1%

Published 2026-03-26Updated 2026-04-16

PoC

Vulnerability details

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNAGo

EPSS score history

Sources

3 links

PoC links are not available for guest users. Login to view them.

CVE Organization RedHat Vuln DB NVD Analysis

Profile

CVSS

7.5

EPSS

<1%

Published

2026-03-26

Updated

2026-04-16

CNA

Vendors

github.com/jackc/pgproto3/v2

1 product

CPEs

cpe:/o:redhat:enterprise_linux:10.2

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/a:redhat:multicluster_globalhub:1.3::el9

cpe:/a:redhat:multicluster_globalhub:1.4::el9

cpe:/a:redhat:multicluster_globalhub:1.5::el9

cpe:/a:redhat:multicluster_globalhub:1.6::el9

cpe:/a:redhat:advanced_cluster_security:4.8::el8

cpe:/a:redhat:quay:3.12::el8

cpe:/a:redhat:quay:3.14::el8

cpe:/a:redhat:quay:3.15::el8

cpe:/a:redhat:quay:3.16::el9

cpe:/a:redhat:quay:3.17::el9

cpe:/a:redhat:quay:3.10::el8

cpe:/a:redhat:quay:3.9::el8

cpe:/a:redhat:assisted_installer:2

cpe:/a:redhat:multicluster_engine

cpe:/a:redhat:acm:2

cpe:/o:redhat:enterprise_linux:8

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift_cluster_manager_cli:1

cpe:/a:redhat:openshift_service_on_aws:1

cpe:/a:redhat:quay:3

cpe:/a:redhat:multicluster_globalhub

cpe:/a:redhat:advanced_cluster_security:4

cpe:/a:redhat:hummingbird:1

cpe:/a:redhat:openshift:4

cpe:/a:redhat:trusted_artifact_signer:1

cpe:/a:redhat:enterprise_linux:9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated