Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-05-08T15:53:00 github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CWE-89

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

A flaw was found in pgx, a PostgreSQL driver and toolkit for Go. This SQL injection vulnerability can occur when using the non-default simple protocol, a dollar-quoted string literal in the SQL query, and when that string literal contains text interpreted as a placeholder with an attacker-controlled value. An attacker could potentially manipulate SQL queries, leading to a low impact on data integrity.

Avoid using the non-default simple protocol in applications that use the pgx PostgreSQL driver for Go. The vulnerability is contingent on this non-default protocol and specific SQL query constructs. Configuring applications to use the default extended protocol prevents this issue. If the simple protocol is necessary, ensure that dollar-quoted string literals do not contain attacker-controlled placeholder values. Red Hat Hardened Images 2026-05-09T00:00:00Z RHSA-2026:15856 go-fdo-server-main-1.0.1-0.2.hum1 Red Hat Hardened Images 2026-05-12T00:00:00Z RHSA-2026:16133 caddy-main-2.11.3-0.1.hum1 Red Hat Hardened Images 2026-06-10T00:00:00Z RHSA-2026:25138 cosign-main-3.1.1-0.1.hum1 Assisted Installer for Red Hat OpenShift Container Platform 2 Fix deferred rhai/assisted-installer-agent-rhel9 Assisted Installer for Red Hat OpenShift Container Platform 2 Fix deferred rhai/assisted-installer-controller-rhel9 Assisted Installer for Red Hat OpenShift Container Platform 2 Fix deferred rhai/assisted-installer-rhel9 Cryostat 4 Fix deferred cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Fix deferred custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Fix deferred custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Fix deferred custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Fix deferred custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-installer-agent-rhel8 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-installer-agent-rhel9 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-installer-controller-rhel8 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-installer-controller-rhel9 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-installer-rhel8 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-installer-rhel9 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-service-8-rhel8 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/assisted-service-9-rhel9 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/azure-service-operator-rhel9 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/cluster-api-provider-aws-rhel9 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-agent-rhel8 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-agent-rhel9 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-manager-rhel8 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-manager-rhel9 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-operator-bundle Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-rhel8-operator Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-rhel9-operator OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-hub-api-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-hub-api-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-hub-db-migration-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-hub-db-migration-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-results-api-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-results-api-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-results-retention-policy-agent-rhel9 OpenShift Service Mesh 2 Fix deferred openshift-service-mesh/istio-rhel8-operator Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/3scale-operator-bundle Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/3scale-rhel7-operator Red Hat 3scale API Management Platform 2 Fix deferred 3scale-amp2/3scale-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/acm-search-indexer-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/acm-search-v2-api-rhel9 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-rhel8-operator Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-roxctl-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-scanner-v4-rhel8 Red Hat Ceph Storage 6 Fix deferred rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Fix deferred rhceph/alloy-rhel10 Red Hat Ceph Storage 9 Fix deferred rhceph/grafana-rhel10 Red Hat Edge Manager 1 Fix deferred flightctl Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alert-exporter-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alert-exporter-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alertmanager-proxy-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-alertmanager-proxy-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-api-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-api-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-cli-artifacts-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-cli-artifacts-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-db-setup-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-db-setup-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-api-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-api-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-worker-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-imagebuilder-worker-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-pam-issuer-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-pam-issuer-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-periodic-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-periodic-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-telemetry-gateway-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-telemetry-gateway-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-userinfo-proxy-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-userinfo-proxy-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-worker-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-worker-rhel9 Red Hat Enterprise Linux 10 Fix deferred go-fdo-server Red Hat Enterprise Linux 10 Fix deferred osbuild-composer Red Hat Enterprise Linux 8 Fix deferred osbuild-composer Red Hat Enterprise Linux 9 Fix deferred osbuild-composer Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-codeflare-operator-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-codeflare-operator-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-maas-api-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-api-server-v2-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-api-server-v2-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-driver-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-driver-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-launcher-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-launcher-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-model-registry-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/azure-service-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/o-cloud-manager-operator-bundle Red Hat OpenShift Container Platform 4 Fix deferred openshift4/o-cloud-manager-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-api-server-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-api-server-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-csr-approver-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-csr-approver-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-node-agent-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-node-agent-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-orchestrator-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-orchestrator-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-aws-cluster-api-controllers-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-baremetal-installer-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-cluster-control-plane-machine-set-rhel9-operator Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-installer-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-cloudnative-pg-rhel9-operator Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-rhel9 Red Hat OpenStack Platform 18.0 Fix deferred rhoso-operators/openstack-operator-bundle Red Hat Quay 3 Fix deferred quay/clair-rhel8 Red Hat Quay 3 Fix deferred quay/clair-rhel9 Red Hat Quay 3 Fix deferred quay/quay-operator-rhel8 Red Hat Quay 3 Fix deferred quay/quay-operator-rhel9 Red Hat Quay 3 Fix deferred quay/quay-rhel8 Red Hat Quay 3 Fix deferred quay/quay-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/certificate-transparency-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/cosign-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/createtree-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/trillian-database-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/trillian-logserver-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/trillian-logsigner-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/updatetree-rhel9 Zero Trust Workload Identity Manager Fix deferred zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9 Zero Trust Workload Identity Manager Fix deferred zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9 Zero Trust Workload Identity Manager Fix deferred zero-trust-workload-identity-manager/spiffe-spire-server-rhel9 Zero Trust Workload Identity Manager - Tech Preview Fix deferred zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9 Zero Trust Workload Identity Manager - Tech Preview Fix deferred zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9 Zero Trust Workload Identity Manager - Tech Preview Fix deferred zero-trust-workload-identity-manager/spiffe-spire-server-rhel9 Zero Trust Workload Identity Manager - Tech Preview Fix deferred zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-operator-bundle Zero Trust Workload Identity Manager - Tech Preview Fix deferred zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-41889 https://nvd.nist.gov/vuln/detail/CVE-2026-41889 https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da https://github.com/jackc/pgx/releases/tag/v5.9.2 https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx