Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx

published 2024-07-02 2y ago modified 2026-03-19 7mo ago also GO-2024-2567

cvss: 5.3; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Pipeline can panic when PgConn is busy or closed.

Patch / fix

fixed in 1 links 1

go github.com/jackc/pgx/v5 5.5.2

github.com/jackc/pgx@dfd1980 commit

Is GHSA-fqpg-rq76-99pq in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem	package	affected	fixed in
go	github.com/jackc/pgx/v5	<5.5.2 >=5.0.0-alpha.5, <5.5.2	5.5.2

Classification

Weakness

CWE-754 Improper Check for Unusual or Exceptional Conditions

References

github.com /jackc/pgx/commit/dfd198003a03dbb96e4607b0d3a0bb9a7398ccb7
web, patch
github.com /jackc/pgx
package

Sources

GitHub Advisory GHSA-fqpg-rq76-99pq
OSV GO-2024-2567

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.