Npgsql Vulnerable to SQL Injection via Protocol Message Size Overflow
Summary
CVE-2024-32655: Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow. Affects Npgsql across 6 version ranges.
< 4.0.14
>= 4.1.0, < 4.1.13
>= 5.0.0, < 5.0.18
>= 6.0.0, < 6.0.11
>= 7.0.0, < 7.0.7
>= 8.0.0, < 8.0.3
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- Npgsql · ghsa
The same CVE-2024-32655 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Npgsql is an open-source ADO.NET Data Provider for PostgreSQL, allowing .NET applications to communicate with PostgreSQL databases. It provides a high-performance, fully asynchronous, and scalable interface for accessing and manipulating data in PostgreSQL. However, a vulnerability has been discovered in Npgsql that allows for SQL injection via a protocol message size overflow.
Vulnerability Detail
The vulnerability arises from the WriteBind() method in NpgsqlConnector.FrontendMessages.cs, which uses int variables to store the message length and the sum of parameter lengths. When the sum of parameter lengths becomes too large, these variables overflow, resulting in Npgsql writing a message size that is too small. Consequently, when the message is parsed by the database, it reads only a small number of bytes and treats any following bytes as new messages, even though they belong to the old message. This allows attackers to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf.
How To Fix
Latest published version: 10.0.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.0.144.0.14 -
>= 4.1.0, < 4.1.134.1.13 -
>= 5.0.0, < 5.0.185.0.18 -
>= 6.0.0, < 6.0.116.0.11 -
>= 7.0.0, < 7.0.77.0.7 -
>= 8.0.0, < 8.0.38.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization to prevent SQL injection attacks. This can be achieved by using parameterized queries or prepared statements, which ensure that user input is properly escaped and treated as data rather than executable code. Here is an example of using parameterized queries in Npgsql:
using (var connection = new NpgsqlConnection(connectionString))
{
connection.Open();
using (var command = new NpgsqlCommand("SELECT * FROM users WHERE username = @username", connection))
{
command.Parameters.AddWithValue("@username", username);
// Execute the command
}
}
Conclusion
The vulnerability in Npgsql that allows for SQL injection via protocol message size overflow can have significant security implications for applications using Npgsql to communicate with PostgreSQL databases. It is crucial to upgrade to the latest version of Npgsql (8.0.3 or later) to ensure the vulnerability is patched. Additionally, implementing input validation and sanitization techniques, such as parameterized queries, can provide an extra layer of protection against SQL injection attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Npgsql →
FAQ
The vulnerability allows attackers to execute arbitrary SQL statements on the application's behalf. The impact depends on the application that uses Npgsql, the data it stores in PostgreSQL, and the privileges of the database user.
Versions of Npgsql up to and including 8.0.2 are affected by this vulnerability.
Yes, a proof-of-concept project is available on GitHub. You can find the steps to exploit the vulnerability in the attached PDF file and the PoC project at the following links:
Yes, this vulnerability has been reviewed by GitHub and the details have been published on their advisory database.
The CVSS v3 score for this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for Npgsql.
