VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/lib/pq: vulnerability history, versions and safety

github.com/lib/pq is a package in the Go ecosystem. Vulert records 7 vulnerabilities for it across 0 release, first recorded in Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
7 vulnerabilities recorded U7
i
7 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
7 in the last 12 months

Most recent disclosure 18 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/lib/pq vulnerabilities

Vulert verdict on github.com/lib/pq v1.12.3 i

Updated on 23 Oct 2026

Good news: v1.12.3, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 7.

Package health score 65/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Stay on v1.12.3 or newer. This can change: a vulnerability disclosed tomorrow can affect v1.12.3 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release v1.12.3 — unaffected i
  • Vulnerabilities on record 7 over 1 year · 7 in the last year i
  • Latest disclosure 18 Aug 2026 i
  • Highest CVSS n/a i
  • With no published fix 7 i
  • Stars 9,969 i
  • OpenSSF scorecard 3/10 i
  • Last release 6 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/lib/pq, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20260820222753-451ac10e4e85 20 Aug 2026 none MIT — Details →
v1.12.4-0.20260820222753-451ac10e4e85 20 Aug 2026 none MIT — Details →
v0.0.0-20260818200449-4cd6ec55b315 18 Aug 2026 none MIT — Details →
v1.12.4-0.20260818200449-4cd6ec55b315 18 Aug 2026 none MIT — Details →
v0.0.0-20260816161508-2835785690d5 16 Aug 2026 none MIT — Details →
v1.12.4-0.20260816161508-2835785690d5 16 Aug 2026 none MIT — Details →
v0.0.0-20260803193607-f4654a41a62b 03 Aug 2026 none MIT — Details →
v1.12.4-0.20260803193607-f4654a41a62b 03 Aug 2026 none MIT — Details →
v1.12.4-0.20260803152524-727c63593b64 03 Aug 2026 none MIT — Details →
v0.0.0-20260727205347-10237a65609e 27 Jul 2026 none MIT — Details →
v1.12.4-0.20260727205347-10237a65609e 27 Jul 2026 none MIT — Details →
v0.0.0-20260726212313-c152f32e977b 26 Jul 2026 none MIT — Details →
v1.12.4-0.20260726212313-c152f32e977b 26 Jul 2026 none MIT — Details →
v0.0.0-20260711203001-d70e69988c9f 11 Jul 2026 none MIT — Details →
v1.12.4-0.20260711203001-d70e69988c9f 11 Jul 2026 none MIT — Details →
v0.0.0-20260711194334-b125f757db35 11 Jul 2026 none MIT — Details →
v1.12.4-0.20260711194334-b125f757db35 11 Jul 2026 none MIT — Details →
v0.0.0-20260408231220-76df97d6b105 08 Apr 2026 none MIT — Details →
v1.12.4-0.20260408231220-76df97d6b105 08 Apr 2026 none MIT — Details →
v0.0.0-20260408155200-8d4557b41f35 08 Apr 2026 none MIT — Details →
v0.0.0-20260408150540-004e5e8d262f 08 Apr 2026 none MIT — Details →
v1.12.4-0.20260408150540-004e5e8d262f 08 Apr 2026 none MIT — Details →
v0.0.0-20260408144437-54c60564d284 08 Apr 2026 none MIT — Details →
v0.0.0-20260403154516-1f3e3d92865d 03 Apr 2026 none MIT — Details →
v1.12.3 03 Apr 2026 none MIT — Details →
v0.0.0-20260402111909-32ba56b8f9c0 02 Apr 2026 none MIT — Details →
v1.12.3-0.20260402111909-32ba56b8f9c0 02 Apr 2026 none MIT — Details →
v0.0.0-20260402095131-c2cfac15d504 02 Apr 2026 none MIT — Details →
v1.12.2 02 Apr 2026 none MIT — Details →
v0.0.0-20260402094553-859f10493799 02 Apr 2026 none MIT — Details →
v1.12.2-0.20260402094553-859f10493799 02 Apr 2026 none MIT — Details →
v0.0.0-20260401120409-6d77ced41719 01 Apr 2026 none MIT — Details →
v1.12.2-0.20260401120409-6d77ced41719 01 Apr 2026 none MIT — Details →
v0.0.0-20260401102757-71daecbc4522 01 Apr 2026 none MIT — Details →
v1.12.2-0.20260401102757-71daecbc4522 01 Apr 2026 none MIT — Details →
v0.0.0-20260330133217-1464d694fb07 30 Mar 2026 none MIT — Details →
v1.12.1 30 Mar 2026 none MIT — Details →
v0.0.0-20260330125404-5a64c116462d 30 Mar 2026 none MIT — Details →
v1.11.3-0.20260330125404-5a64c116462d 30 Mar 2026 none MIT — Details →
v0.0.0-20260330123643-ce3c88129104 30 Mar 2026 none MIT — Details →
v1.12.0 18 Mar 2026 none MIT — Details →
v0.0.0-20260318141442-6d40f13cfefe 18 Mar 2026 none MIT — Details →
v1.11.3-0.20260318141442-6d40f13cfefe 18 Mar 2026 none MIT — Details →
v0.0.0-20260318125532-87ee06c60034 18 Mar 2026 none MIT — Details →
v0.0.0-20260318010440-09624587cd3d 18 Mar 2026 none MIT — Details →
v1.11.3-0.20260318010440-09624587cd3d 18 Mar 2026 none MIT — Details →
v0.0.0-20260317182133-620d6d50817f 17 Mar 2026 none MIT — Details →
v1.11.3-0.20260317182133-620d6d50817f 17 Mar 2026 none MIT — Details →
v0.0.0-20260317171911-dc8ff5d519b0 17 Mar 2026 none MIT — Details →
v0.0.0-20260317141723-b36c912fcb98 17 Mar 2026 none MIT — Details →
v1.11.3-0.20260317141723-b36c912fcb98 17 Mar 2026 none MIT — Details →
v0.0.0-20260316120615-1e8ca8d7fb67 16 Mar 2026 none MIT — Details →
v1.11.3-0.20260316120615-1e8ca8d7fb67 16 Mar 2026 none MIT — Details →
v0.0.0-20260316104545-cae0adb26cdd 16 Mar 2026 none MIT — Details →
v1.11.3-0.20260316104545-cae0adb26cdd 16 Mar 2026 none MIT — Details →
v0.0.0-20260314210848-a2005c145155 14 Mar 2026 none MIT — Details →
v1.11.3-0.20260314210848-a2005c145155 14 Mar 2026 none MIT — Details →
v0.0.0-20260312213958-5e55bb7c2a77 12 Mar 2026 none MIT — Details →
v1.11.3-0.20260312213958-5e55bb7c2a77 12 Mar 2026 none MIT — Details →
v0.0.0-20260311235152-2a2614c3ca9d 11 Mar 2026 none MIT — Details →
v1.11.3-0.20260311235152-2a2614c3ca9d 11 Mar 2026 none MIT — Details →
v0.0.0-20260311225402-5db0f0d39a1d 11 Mar 2026 none MIT — Details →
v1.11.3-0.20260311225402-5db0f0d39a1d 11 Mar 2026 none MIT — Details →
v0.0.0-20260311160221-5d20cc3a9487 11 Mar 2026 none MIT — Details →
v1.11.3-0.20260311160221-5d20cc3a9487 11 Mar 2026 none MIT — Details →
v0.0.0-20260311035911-7517e07b3228 11 Mar 2026 none MIT — Details →
v1.11.3-0.20260311035911-7517e07b3228 11 Mar 2026 none MIT — Details →
v0.0.0-20260310152740-f3ef532aae5a 10 Mar 2026 none MIT — Details →
v1.11.3-0.20260310152740-f3ef532aae5a 10 Mar 2026 none MIT — Details →
v0.0.0-20260310144142-2cf144f912c1 10 Mar 2026 none MIT — Details →
v0.0.0-20260310015834-59491bdcfc17 10 Mar 2026 none MIT — Details →
v1.11.3-0.20260310015834-59491bdcfc17 10 Mar 2026 none MIT — Details →
v0.0.0-20260310012658-c66ad001358b 10 Mar 2026 none MIT — Details →
v0.0.0-20260309162715-c321a5776763 09 Mar 2026 none MIT — Details →
v1.11.3-0.20260309162715-c321a5776763 09 Mar 2026 none MIT — Details →
v0.0.0-20260309134739-3b56ab470bab 09 Mar 2026 none MIT — Details →
v1.11.3-0.20260309134739-3b56ab470bab 09 Mar 2026 none MIT — Details →
v0.0.0-20260305160911-335685473c46 05 Mar 2026 none MIT — Details →
v1.11.3-0.20260305160911-335685473c46 05 Mar 2026 none MIT — Details →
v0.0.0-20260218182013-89e7b23fe859 18 Feb 2026 none MIT — Details →
v1.11.3-0.20260218182013-89e7b23fe859 18 Feb 2026 none MIT — Details →
v0.0.0-20260212140111-262be4adbb8c 12 Feb 2026 none MIT — Details →
v1.11.3-0.20260212140111-262be4adbb8c 12 Feb 2026 none MIT — Details →
v0.0.0-20260212120307-91f52d151a86 12 Feb 2026 none MIT — Details →
v1.11.3-0.20260212120307-91f52d151a86 12 Feb 2026 none MIT — Details →
v0.0.0-20260210121242-141280560b25 10 Feb 2026 none MIT — Details →
v1.11.2 10 Feb 2026 none MIT — Details →
v0.0.0-20260210115412-0c529db1d837 10 Feb 2026 none MIT — Details →
v0.0.0-20260129134843-eec526cee8f5 29 Jan 2026 none MIT — Details →
v1.11.1 29 Jan 2026 none MIT — Details →
v0.0.0-20260129132908-9e2aa8e7b098 29 Jan 2026 none MIT — Details →
v0.0.0-20260128223234-8e88f7e928ec 28 Jan 2026 none MIT — Details →
v1.11.0 28 Jan 2026 none MIT — Details →
v0.0.0-20260124225939-f1fae2ee3828 24 Jan 2026 none MIT — Details →
v1.10.10-0.20260124225939-f1fae2ee3828 24 Jan 2026 none MIT — Details →
v0.0.0-20260124163306-3815d03993a5 24 Jan 2026 none MIT — Details →
v1.10.10-0.20260124163306-3815d03993a5 24 Jan 2026 none MIT — Details →
v0.0.0-20260124145109-589ad43c7e1f 24 Jan 2026 none MIT — Details →
v1.10.10-0.20260124145109-589ad43c7e1f 24 Jan 2026 none MIT — Details →
v0.0.0-20260122160210-dd34b7111be1 22 Jan 2026 none MIT — Details →
v1.10.10-0.20260122160210-dd34b7111be1 22 Jan 2026 none — — Details →
v0.0.0-20260121132927-91312493ea55 21 Jan 2026 none — — Details →
v1.10.10-0.20260121132927-91312493ea55 21 Jan 2026 none — — Details →
v0.0.0-20260120205106-35ce81bceb29 20 Jan 2026 none — — Details →
v1.10.10-0.20260120205106-35ce81bceb29 20 Jan 2026 none — — Details →
v0.0.0-20260120192248-f1b4c41caf27 20 Jan 2026 none — — Details →
v1.10.10-0.20260120192248-f1b4c41caf27 20 Jan 2026 none — — Details →
v0.0.0-20260120171330-7666f295e00e 20 Jan 2026 none — — Details →
v1.10.10-0.20260120171330-7666f295e00e 20 Jan 2026 none — — Details →
v1.10.10-0.20260120165352-e5e969c25453 20 Jan 2026 none — — Details →
v0.0.0-20260119174321-e1fe05871beb 19 Jan 2026 none — — Details →
v1.10.10-0.20260119174321-e1fe05871beb 19 Jan 2026 none — — Details →
v0.0.0-20260119170123-fc449c66bdf6 19 Jan 2026 none — — Details →
v1.10.10-0.20260119170123-fc449c66bdf6 19 Jan 2026 none — — Details →
v0.0.0-20260119154117-9f5555d0b3b0 19 Jan 2026 none — — Details →
v1.10.10-0.20260119154117-9f5555d0b3b0 19 Jan 2026 none — — Details →
v0.0.0-20260119141459-27a1c3ae5dcd 19 Jan 2026 none — — Details →
v1.10.10-0.20260119141459-27a1c3ae5dcd 19 Jan 2026 none — — Details →
v1.10.10-0.20260119135242-dcaeb5e40f89 19 Jan 2026 none — — Details →
v0.0.0-20260118193048-13013dbb2e00 18 Jan 2026 none — — Details →

The newest 120 of 600 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2026 7

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 7 of the 7 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/lib/pq

The 5 most severe of 7 vulnerabilities recorded for this package

Search all 7 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2026-56868: GSS Authentication Flaw in github.com/lib/pq Leading to Insecure Connections N/A unrated No fix published 18 Aug 2026
CVE-2026-56869: Denial of Service Vulnerability in github.com/lib/pq due to Unbounded SCRAM Iteration Count N/A unrated No fix published 18 Aug 2026
CVE-2026-56870: Credential Disclosure Vulnerability in github.com/lib/pq N/A unrated No fix published 18 Aug 2026
CVE-2026-56871: Panic in github.com/lib/pq Due to Malformed Backend Frame Length N/A unrated No fix published 18 Aug 2026
CVE-2026-56872: github.com/lib/pq Malformed RowDescription and DataRow Messages Cause Panics N/A unrated No fix published 18 Aug 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/lib/pq

Is github.com/lib/pq safe to use?

Vulert records 7 vulnerabilities for github.com/lib/pq in Go: 0 critical, 0 high, 0 medium and 0 low, plus 7 not yet rated. 7 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/lib/pq's Vulert package health score?

Vulert scores github.com/lib/pq 65/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/lib/pq affected?

No. v1.12.3, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

Which version of github.com/lib/pq should I use?

v1.12.3 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/lib/pq have?

7 vulnerabilities are recorded for github.com/lib/pq in the Go ecosystem: 0 critical, 0 high, 0 medium and 0 low, plus 7 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/lib/pq vulnerabilities disclosed?

7 vulnerabilities were recorded for github.com/lib/pq in the last 12 months, and the oldest entry in this database dates to 18 Aug 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/lib/pq are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/lib/pq for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/lib/pq version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.