CVE-2024-27304

What it actually does

Integer overflow in pgx message size calculation allows a query or bind message exceeding 4 GB to be transmitted as multiple attacker-controlled messages, enabling SQL injection.

Why it matters to the business

Attackers can execute arbitrary database commands, risking data theft, corruption, or service disruption in applications using vulnerable pgx versions; widespread Go PostgreSQL driver usage amplifies exposure despite low EPSS and non-KEV status.

How an attack unfolds

An attacker supplies specially crafted input causing a single query or bind message to exceed 4 GB, triggering an integer overflow that splits the message; subsequent messages under attacker control inject malicious SQL statements into the PostgreSQL backend.

How to fix it

Upgrade pgx to v4.18.2 or v5.5.4; for Debian 12 systems apply package updates to version 6.1.106-1; implement input validation to reject queries or binds approaching 4 GB as a temporary workaround.

How to confirm the fix worked

Verify pgx version in go.mod or deployed binaries against fixed releases; attempt to send oversized queries in a test environment and confirm single-message handling without fragmentation; review database logs for unexpected multi-message sequences.

Typical attack path

1. Locate web or application endpoints accepting user input passed to pgx queries or binds
2. Craft and submit input sized to exceed 4 GB in a single query or bind message
3. Exploit resulting integer overflow to fragment the message into multiple controlled packets
4. Inject SQL payloads via the fragmented messages to execute unauthorized database operations

How to detect it

Inspect application and database logs for unusually large query or bind messages; correlate with PostgreSQL server logs showing fragmented multi-message sequences from the same session; review Go application error or debug logs for size-calculation anomalies.

What your security team should do

• Immediately upgrade all pgx dependencies to v4.18.2 or v5.5.4 or apply Debian 6.1.106-1 patches
• Add server-side input length checks rejecting payloads near 4 GB
• Monitor EPSS trend and scan for any new exploit maturity indicators
• Audit all Go applications for direct use of vulnerable pgx query/bind paths