CVE-2024-27304

Name of the Vulnerable Software and Affected Versions pgx versions prior to 4.18.2 pgx versions prior to 5.5.4

Description SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Recommendations For pgx versions prior to 4.18.2, update to version 4.18.2 or later. For pgx versions prior to 5.5.4, update to version 5.5.4 or later. As a temporary workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.