CVE-2026-33815

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
github.com/jackc/pgx/v5github.com/jackc/pgx/v5/pgproto3< 5.9.0
Red HatCryostat 4 on RHEL 9—
Red HatRHEM 1.0 for RHEL 9—
Red HatRHEM 1.1 for RHEL 10—
Red HatRHEM 1.1 for RHEL 9—
Red HatCustom Metric Autoscaler 2.19—
Red HatCustom Metric Autoscaler 2.19—
Red HatCustom Metric Autoscaler 2.19—
Red HatCustom Metric Autoscaler 2.19—
Red HatMulticluster Global Hub 1.3.4—
Red HatMulticluster Global Hub 1.3.4—
Red HatMulticluster Global Hub 1.3.4—
Red HatMulticluster Global Hub 1.7.0—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—
Red HatRed Hat Advanced Cluster Security 4.8—
Red HatRed Hat Advanced Cluster Security 4.8—
Red HatRed Hat Advanced Cluster Security 4.8—
Red HatRed Hat Advanced Cluster Security 4.9—
Red HatRed Hat Advanced Cluster Security 4.9—
Red HatRed Hat Advanced Cluster Security 4.9—
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.10—
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.10—
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.10—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Openshift Data Foundation 4.20—
Red HatRed Hat Trusted Artifact Signer 1.3—
Red HatRed Hat Trusted Artifact Signer 1.3—
Red HatRed Hat Trusted Artifact Signer 1.3—

References

Timeline

Published
Apr 7, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-338169.8Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-338187.5Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-338199.8Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.CVE-2026-33825.5A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the CVE-2026-338219.9Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a networkCVE-2026-338226.1Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-338236.5Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.CVE-2026-338249.8Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.CVE-2026-338257.8Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.CVE-2026-338268.0Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.CVE-2026-338278.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attackeCVE-2026-338287.8Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.
CVE-2026-33815: Critical severity, CVSS 9.8 | Vulnix