CVE-2026-32286

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-129CWE-1285

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2026
Last modified
Sep 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-322877.5Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be trCVE-2026-322885.5tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regionsCVE-2026-322896.1Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when bCVE-2026-32295.5An integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data wasCVE-2026-322904.7The GL-iNet Comet (GL-RM1) KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-inCVE-2026-322916.8The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically openCVE-2026-322927.5The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials.CVE-2026-322933.7The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verifyCVE-2026-322944.7JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update serveCVE-2026-322957.5JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials.CVE-2026-322968.2Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker withCVE-2026-322977.5The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Mod
CVE-2026-32286: High severity, CVSS 7.5 | Vulnix