CVE-2026-32286
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Mar 26, 2026
CISA due date
—
The record
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | bento | 0 | 1.16.1-r1 |
| Chainguard | bento-fips | 0 | 1.16.1-r1 |
| Chainguard | flyte | 0 | 0 |
| Chainguard | src | 0 | 0 |
| Chainguard | steampipe | 0 | 2.4.0-r4 |
| Chainguard | telegraf-1.37 | 0 | 1.37.3-r7 |
| Chainguard | telegraf-1.38 | 0 | 1.38.1-r2 |
| Chainguard | teleport-18.6 | 0 | 0 |
| Chainguard | teleport-18.6-operator | 0 | 0 |
| Chainguard | teleport-operator-fips-16 | 0 | 0 |
| Chainguard | teleport-operator-fips-17 | 0 | 0 |
| Chainguard | teleport-operator-fips-18 | 0 | 0 |
| Wolfi | bento | 0 | 1.16.1-r1 |
| Wolfi | flyte | 0 | 0 |
| Wolfi | src | 0 | 0 |
| Wolfi | steampipe | 0 | 2.4.0-r4 |
| Wolfi | telegraf-1.37 | 0 | 1.37.3-r7 |
| Wolfi | telegraf-1.38 | 0 | 1.38.1-r2 |
| Wolfi | teleport-18.6 | 0 | 0 |
| Wolfi | teleport-18.6-operator | 0 | 0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260326T203309-150000.1.155.2 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260402T184258-150000.1.158.1 |
Related vulnerabilities
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects bento
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects bento
- CVE-2026-4427 Rejected reason: Duplicate of CVE-2026-32286 Also affects bento
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects bento
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects bento
- CVE-2026-24051 OpenTelemetry-Go is the Go implementation of OpenTelemetry. Also affects bento
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects bento
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects bento