CVE detail
CVE-2026-32286
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 30.0 · diversity 16.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
23 source links · newest first
- https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgxsecurityinfinity.com
No excerpt available.
Exploitsecurityinfinity.comMar 26, 2026, 8:16 PM - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32286.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMar 26, 2026, 8:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2451847bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/security/cve/CVE-2026-32286access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:24853access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:23345access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:22714access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:22465access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:22450access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:22423access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:22347access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:21769access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:21017access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:19375access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:11996access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:11916access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:11856access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:11217access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://access.redhat.com/errata/RHSA-2026:11070access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 PM - https://pkg.go.dev/vuln/GO-2026-4518pkg.go.dev
No excerpt available.
Exploitpkg.go.devMar 26, 2026, 8:16 PM - https://github.com/jackc/pgx/issues/2507github.com
No excerpt available.
Exploitgithub.comMar 26, 2026, 8:16 PM No excerpt available.
Exploitgithub.comMar 26, 2026, 8:16 PMNo excerpt available.
Exploitgithub.comMar 26, 2026, 8:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-40886CVSS 7.7 · High
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer'…
- CVE-2026-32285CVSS 7.5 · High
The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of serv…
- CVE-2026-2006CVSS 8.8 · High
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to e…
- CVE-2025-3357CVSS 9.8 · Critical
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code due to improper validation of an index value of a dynamically…
- CVE-2023-46724CVSS 8.6 · High
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl`…
- CVE-2020-25241CVSS 7.5 · High
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). The underlying TCP stack of the affected products does not correctly validate the sequence num…