VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/jackc/pgproto3/v2: vulnerability history, versions and safety

github.com/jackc/pgproto3/v2 is a package in the Go ecosystem. Vulert records 4 vulnerabilities for it across 75 releases, from Mar 2024 to Mar 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
4 vulnerabilities recorded H2 U2
i
3 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
3 in the last 12 months

Most recent disclosure 19 Mar 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/jackc/pgproto3/v2 vulnerabilities

Vulert verdict on github.com/jackc/pgproto3/v2 v2.3.3 i

Updated on 23 Oct 2026

Careful: v2.3.3 has 2 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Some issues to review
  • Maintenance Maintaining
  • Popularity Niche
  • Community Quiet

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v2.3.3 — affected i
  • Vulnerabilities on record 4 over 2 years · 3 in the last year i
  • Latest disclosure 19 Mar 2026 i
  • Highest CVSS 7.5 i
  • With no published fix 3 i
  • Stars 172 i
  • OpenSSF scorecard 2/10 i
  • Last release 31 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/jackc/pgproto3/v2, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v2.0.0-20250125160525-bc041643406d 25 Jan 2025 H1 U1 MIT No Details →
v2.3.3-0.20250125160525-bc041643406d 25 Jan 2025 H1 U1 MIT No Details →
v2.3.4-0.20250125160525-bc041643406d 25 Jan 2025 H1 U1 MIT No Details →
v2.3.4-0.20240509212426-c3699e8c28c0 09 May 2024 H1 U1 MIT No Details →
v2.3.3 04 Mar 2024 H1 U1 MIT No Details →
v2.3.3-0.20240304142716-945c2126f6db 04 Mar 2024 H1 U1 MIT No Details →
v2.0.0-20220917154436-0c0f7b03fb49 17 Sep 2022 H1 U1 MIT No Details →
v2.3.2 17 Sep 2022 H1 U1 MIT No Details →
v2.3.2-0.20220917154436-0c0f7b03fb49 17 Sep 2022 H1 U1 MIT No Details →
v2.3.2-0.20220910125726-f59ff94cbed8 10 Sep 2022 H1 U1 MIT No Details →
v2.0.0-20220701023646-fd427c06da93 01 Jul 2022 H1 U1 MIT No Details →
v2.3.1 01 Jul 2022 H1 U1 MIT No Details →
v2.3.1-0.20220701023646-fd427c06da93 01 Jul 2022 H1 U1 MIT No Details →
v2.2.1-0.20220412121321-175856ffd3c8 12 Apr 2022 H1 U1 MIT No Details →
v2.3.0 12 Apr 2022 H1 U1 MIT No Details →
v2.2.1-0.20220402235859-1d7886b01260 02 Apr 2022 H1 U1 MIT No Details →
v2.2.1-0.20220402235859-c6ccb4b9a3dd 02 Apr 2022 H1 U1 MIT No Details →
v2.2.1-0.20220402235859-e14500328861 02 Apr 2022 H1 U1 MIT No Details →
v2.2.1-0.20220402235859-fa2b09640075 02 Apr 2022 H1 U1 MIT No Details →
v2.1.2-0.20211106213943-3d9a54f09287 06 Nov 2021 H1 U1 MIT No Details →
v2.1.2-0.20211106213943-40ecac487c46 06 Nov 2021 H1 U1 MIT No Details →
v2.1.2-0.20211106213943-9275da562f35 06 Nov 2021 H1 U1 MIT No Details →
v2.2.0 06 Nov 2021 H1 U1 MIT No Details →
v2.1.2-0.20211030140858-5c447ff35d29 30 Oct 2021 H1 U1 MIT No Details →
v2.1.1 07 Jul 2021 H1 U1 MIT No Details →
v2.1.1-0.20210707231044-033ca7d47f43 07 Jul 2021 H1 U1 MIT No Details →
v2.1.1-0.20210707010814-6bce4a18780e 07 Jul 2021 H1 U1 MIT No Details →
v2.1.1-0.20210707010755-aaef9bbc35b8 07 Jul 2021 H1 U1 MIT No Details →
v2.1.1-0.20210707010133-2d3823838e54 07 Jul 2021 H1 U1 MIT No Details →
v2.1.1-0.20210701215314-10c6c50ac963 01 Jul 2021 H1 U1 MIT No Details →
v2.1.0 12 Jun 2021 H1 U1 MIT No Details →
v2.0.8-0.20210529160605-28c20e93c0f5 29 May 2021 H1 U1 MIT No Details →
v2.0.8-0.20210522163425-9c2c389e0673 22 May 2021 H1 U1 MIT No Details →
v2.0.8-0.20210522163425-ba924e5715ad 22 May 2021 H1 U1 MIT No Details →
v2.0.7 28 Dec 2020 H1 U1 MIT No Details →
v2.0.1-0.20201117225705-88b6398594fc 17 Nov 2020 H1 U1 MIT No Details →
v2.0.7-0.20201117225705-88b6398594fc 17 Nov 2020 H1 U1 MIT No Details →
v2.0.6 04 Nov 2020 H1 U1 MIT No Details →
v2.0.5 17 Sep 2020 H1 U1 MIT No Details →
v2.0.5-0.20200917220330-835cf1b0689d 17 Sep 2020 H1 U1 MIT No Details →
v2.0.5-0.20200905163023-fede0ce5d658 05 Sep 2020 H1 U1 MIT No Details →
v2.0.5-0.20200831220920-08088ecf9a92 31 Aug 2020 H1 U1 MIT No Details →
v2.0.5-0.20200828214924-6677e2430fd2 28 Aug 2020 H1 U1 MIT No Details →
v2.0.5-0.20200828214840-5847a2671a74 28 Aug 2020 H1 U1 MIT No Details →
v2.0.4 01 Aug 2020 H1 U1 MIT No Details →
v2.0.4-0.20200731221323-2799a6e9a6b9 31 Jul 2020 H1 U1 MIT No Details →
v2.0.3 31 Jul 2020 H1 U1 MIT No Details →
v2.0.3-0.20200731214206-6d0b4c45e418 31 Jul 2020 H1 U1 MIT No Details →
v2.0.2 18 May 2020 H1 U1 MIT No Details →
v2.0.2-0.20200518135234-7746f223e058 18 May 2020 H1 U1 MIT No Details →
v2.0.1 17 Jan 2020 H1 U1 MIT No Details →
v2.0.1-0.20200117225505-595780be0f9f 17 Jan 2020 H1 U1 MIT No Details →
v2.0.1-0.20191218012801-1c20e7d36efa 18 Dec 2019 H1 U1 MIT No Details →
v2.0.1-0.20191218012157-e6b823d64953 18 Dec 2019 H1 U1 MIT No Details →
v2.0.0-rc3.0.20190908152906-a90ef7ed5b85 08 Sep 2019 H1 U1 MIT No Details →
v2.0.1-0.20190908152906-a90ef7ed5b85 08 Sep 2019 H1 U1 MIT No Details →
v2.0.0 07 Sep 2019 H1 U1 MIT No Details →
v2.0.0-rc3.0.20190907164131-eca1e51822f3 07 Sep 2019 H1 U1 MIT No Details →
v2.0.0-rc3.0.20190907163743-80f2cbce255e 07 Sep 2019 H1 U1 MIT No Details →
v2.0.0-rc3.0.20190831210041-4c03ce451f29 31 Aug 2019 H1 U1 MIT No Details →
v2.0.0-rc2.0.20190831204307-0d1ceed7a690 31 Aug 2019 H1 U1 MIT No Details →
v2.0.0-rc3 31 Aug 2019 H1 U1 MIT No Details →
v2.0.0-rc2.0.20190831194955-439ea11d4737 31 Aug 2019 H1 U1 MIT No Details →
v2.0.0-rc2.0.20190831165326-2bc8f2e6afa5 31 Aug 2019 H1 U1 MIT No Details →
v2.0.0-rc1.0.20190831164801-1ba5dcbe01a0 31 Aug 2019 H1 U1 MIT No Details →
v2.0.0-rc2 31 Aug 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190828021345-76538434cf13 28 Aug 2019 H1 U1 MIT No Details →
v2.0.0-rc1 28 Aug 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190609003834-432c2951c711 09 Jun 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190608233435-bf3a27ae3f6e 08 Jun 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190608152626-18e7e777be8b 08 Jun 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190517182711-a340d5f15f5d 17 May 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190503190755-4acc0f54c6ba 03 May 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190420180111-c116219b62db 20 Apr 2019 H1 U1 MIT No Details →
v2.0.0-alpha1.0.20190419041544-9b6a681f50bf 19 Apr 2019 H1 U1 MIT No Details →

All 75 versions Vulert tracks for this package. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 1
  • 2026 3

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 3 of the 4 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/jackc/pgproto3/v2

The 4 most severe of 4 vulnerabilities recorded for this package

Search all 4 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Denial of Service Vulnerability in pgproto3 Package 7.5 high No fix published 18 Mar 2026
CVE-2026-4427: pgproto3 Package Experiences Denial of Service Due to Negative Field Length 7.5 high No fix published 19 Mar 2026
SQL Injection Vulnerability in github.com/jackc/pgproto3 and github.com/jackc/pgx N/A unrated 2.3.3 14 Mar 2024
Denial of Service Vulnerability in github.com/jackc/pgproto3/v2 - DataRow.Decode Function N/A unrated No fix published 16 Mar 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/jackc/pgproto3/v2

Is github.com/jackc/pgproto3/v2 safe to use?

Vulert records 4 vulnerabilities for github.com/jackc/pgproto3/v2 in Go: 0 critical, 2 high, 0 medium and 0 low, plus 2 not yet rated. 3 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/jackc/pgproto3/v2's Vulert package health score?

Vulert scores github.com/jackc/pgproto3/v2 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/jackc/pgproto3/v2 affected?

Yes. v2.3.3, the version you would install today, has 2 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/jackc/pgproto3/v2 should I use?

v2.3.3 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/jackc/pgproto3/v2 have?

4 vulnerabilities are recorded for github.com/jackc/pgproto3/v2 in the Go ecosystem: 0 critical, 2 high, 0 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/jackc/pgproto3/v2 vulnerabilities disclosed?

3 vulnerabilities were recorded for github.com/jackc/pgproto3/v2 in the last 12 months, and the oldest entry in this database dates to 14 Mar 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/jackc/pgproto3/v2 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/jackc/pgproto3/v2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/jackc/pgproto3/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.