-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper message size validation in protocol message encoding functions. The patches added size checks (e.g., len(ParameterFormatCodes) > math.MaxUint16) and error handling in Encode methods. Functions like Bind.Encode and Query.Encode in pgproto3 were modified to include these validations, indicating they previously lacked proper size checks. These functions construct protocol messages where miscalculations due to large inputs could lead to integer overflows, causing message fragmentation under attacker control - the core of CVE-2024-27304.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/jackc/pgx | go | < 4.18.2 | 4.18.2 |
| github.com/jackc/pgx | go | >= 5.0.0, < 5.5.4 | 5.5.4 |
| github.com/jackc/pgx/v4 | go | < 4.18.2 | 4.18.2 |
| github.com/jackc/pgx/v5 | go | >= 5.0.0, < 5.5.4 | 5.5.4 |