CVE-2026-33816
Fixed in a distro release EPSS <1%CVSS 9.8
Memory-safety vulnerability in github.com/jackc/pgx/v5.
Products: github.com/jackc/pgx/v5/pgproto3, Red Hat Cryostat 4 on RHEL 9, Red Hat Enterprise Linux 10, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Red Hat Custom Metric Autoscaler 2.19, Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.7.0, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Advanced Cluster Security for Kubernetes 4.10, Red Hat Edge Manager 1.1, Red Hat Hardened Images, Red Hat Openshift Data Foundation 4.20, Red Hat OpenShift Pipelines 1.21, Red Hat Trusted Artifact Signer 1.3, Custom Metric Autoscaler operator for Red Hat Openshift, Red Hat Multicluster Engine for Kubernetes, Red Hat Multicluster Global Hub, Red Hat OpenShift Pipelines, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Security 4, Red Hat Edge Manager 1, Red Hat OpenShift AI (RHOAI), Red Hat Quay 3, Red Hat Trusted Artifact Signer, Red Hat Zero Trust Workload Identity Manager, Red Hat Zero Trust Workload Identity Manager - Tech Preview
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/jackc/pgx/v5 | 5.9.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | go-fdo-server | 1.0.1-1.el10_2 |
| AlmaLinux 10 | go-fdo-server-manufacturer | 1.0.1-1.el10_2 |
| AlmaLinux 10 | go-fdo-server-owner | 1.0.1-1.el10_2 |
| AlmaLinux 10 | go-fdo-server-rendezvous | 1.0.1-1.el10_2 |
| Chainguard | argo-workflow-controller-3.7 | 0 |
| Chainguard | argo-workflow-controller-4.0 | 0 |
| Chainguard | argo-workflow-controller-fips-3.7 | 0 |
| Chainguard | argo-workflow-controller-fips-4.0 | 0 |
| Chainguard | argo-workflow-executor-3.7 | 0 |
| Chainguard | argo-workflow-executor-4.0 | 0 |
| Chainguard | argo-workflow-executor-fips-3.7 | 3.7.13-r6 |
| Chainguard | argo-workflow-executor-fips-4.0 | 4.0.4-r6 |
| Chainguard | argo-workflows-3.7 | 0 |
| Chainguard | argo-workflows-4.0 | 0 |
| Chainguard | argo-workflows-fips-3.7 | 0 |
| Chainguard | argo-workflows-fips-4.0 | 0 |
| Chainguard | authentik-2025.12-go-server | 0 |
| Chainguard | authentik-2026.2-go-server | 0 |
| Chainguard | authentik-fips-2025.12-go-server | 0 |
| Chainguard | authentik-fips-2026.2-go-server | 0 |
| Chainguard | azure-service-operator | 0 |
| Chainguard | azure-service-operator-fips | 0 |
| Chainguard | bento | 0 |
| Chainguard | bento-fips | 0 |
| Chainguard | caddy | 0 |
| Chainguard | caddy-fips | 0 |
| Chainguard | cerbos | 0 |
| Chainguard | cerbos-fips | 0 |
| Chainguard | certificate-transparency-fips-trillian-ctserver | 0 |
| Chainguard | certificate-transparency-trillian-ctserver | 0 |
| Chainguard | chainloop-control-plane | 0 |
| Chainguard | chainloop-control-plane-fips | 0 |
| Chainguard | cloudnative-pg | 0 |
| Chainguard | cloudnative-pg-fips | 0 |
| Chainguard | cloudnative-pg-fips-plugins | 1.29.0-r2 |
| Chainguard | cloudnative-pg-plugins | 1.29.0-r3 |
| Chainguard | cloudprober | 0 |
| Chainguard | cloudprober-fips | 0 |
| Chainguard | commercial-chainloop-backend | 1.72.2-r0 |
| Chainguard | commercial-expanso-edge | 2.1.17-r0 |
| Chainguard | commercial-grafana-11.6 | 11.6.16-r0 |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | 12.2.10-r0 |
| Chainguard | commercial-grafana-12.3 | 12.3.8-r0 |
| Chainguard | commercial-grafana-12.4 | 12.4.5-r0 |
| Chainguard | dapr-daprd-1.14 | 0 |
| Chainguard | dapr-daprd-1.15 | 0 |
| Chainguard | dapr-daprd-1.16 | 0 |
| Chainguard | dapr-daprd-1.17 | 0 |
| Chainguard | dapr-daprd-fips-1.14 | 0 |
| Chainguard | dapr-daprd-fips-1.15 | 0 |
| Chainguard | dapr-daprd-fips-1.16 | 0 |
| Chainguard | dapr-daprd-fips-1.17 | 0 |
| Chainguard | envoy-gateway-egctl | 1.7.2-r1 |
| Chainguard | envoy-gateway-fips-1.6-egctl | 1.6.7-r4 |
| Chainguard | envoy-gateway-fips-egctl | 1.7.2-r1 |
| Chainguard | falcosidekick | 0 |
| Chainguard | falcosidekick-fips | 0 |
| Chainguard | ferretdb | 0 |
| Chainguard | flyte | 0 |
| Chainguard | gitaly-18.10 | 0 |
| Chainguard | gitaly-18.11 | 0 |
| Chainguard | gitaly-18.6 | no fix |
| Chainguard | gitaly-18.7 | no fix |
| Chainguard | gitaly-18.8 | no fix |
| Chainguard | gitaly-18.9 | 0 |
| Chainguard | gitaly-fips-18.10 | 0 |
| Chainguard | gitaly-fips-18.11 | 0 |
| Chainguard | gitaly-fips-18.6 | no fix |
| Chainguard | gitaly-fips-18.7 | no fix |
| Chainguard | gitaly-fips-18.8 | no fix |
| Chainguard | gitaly-fips-18.9 | 0 |
| Chainguard | gitlab-container-registry-18.10 | 0 |
| Chainguard | gitlab-container-registry-18.11 | 0 |
| Chainguard | gitlab-container-registry-18.7 | no fix |
| Chainguard | gitlab-container-registry-18.8 | no fix |
| Chainguard | gitlab-container-registry-18.9 | 0 |
| Chainguard | gitlab-container-registry-fips-18.10 | 0 |
| Chainguard | gitlab-container-registry-fips-18.11 | 0 |
| Chainguard | gitlab-container-registry-fips-18.7 | no fix |
| Chainguard | gitlab-container-registry-fips-18.8 | no fix |
| Chainguard | gitlab-container-registry-fips-18.9 | 0 |
| Chainguard | gitlab-elasticsearch-indexer | 0 |
| Chainguard | gitlab-elasticsearch-indexer-fips | 0 |
| Chainguard | gitness | 0 |
| Chainguard | goose | 0 |
| Chainguard | goose-fips | 0 |
| Chainguard | grafana-11.5 | no fix |
| Chainguard | grafana-11.6 | 0 |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | 0 |
| Chainguard | grafana-fips-11.5 | no fix |
| Chainguard | grafana-fips-11.6 | 0 |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | 0 |
| Chainguard | grafana-fips-12.2 | 0 |
| Chainguard | hydra | 0 |
| Chainguard | hydra-fips | 0 |
| Chainguard | jitsucom-bulker-bulker | 0 |
| Chainguard | jitsucom-bulker-sidecar | 0 |
| Chainguard | jitsucom-bulker-syncctl | 0 |
| Chainguard | juicefs-1.2 | 0 |
| Chainguard | juicefs-1.3 | 0 |
| Chainguard | k3s | 1.35.3.1-r3 |
| Chainguard | k3s-1.31 | 1.31.6.1-r18 |
| Chainguard | k3s-1.32 | 1.32.13.1-r12 |
| Chainguard | k3s-1.33 | 1.33.10.1-r7 |
| Chainguard | k3s-1.34 | 1.34.6.1-r3 |
| Chainguard | k3s-1.35 | 1.35.3.1-r2 |
| Chainguard | k3s-static | 1.35.3.1-r3 |
| Chainguard | k3s-static-1.31 | 1.31.6.1-r19 |
| Chainguard | k3s-static-1.31 | 1.31.6.1-r18 |
| Chainguard | k3s-static-1.32 | 1.32.13.1-r12 |
| Chainguard | k3s-static-1.33 | 1.33.10.1-r7 |
| Chainguard | k3s-static-1.34 | 1.34.6.1-r3 |
| Chainguard | k3s-static-1.35 | 1.35.3.1-r2 |
| Chainguard | keda-2.17 | no fix |
| Chainguard | keda-2.17-metrics-apiserver | no fix |
| Chainguard | keda-2.18 | 0 |
| Chainguard | keda-2.18-metrics-apiserver | 0 |
| Chainguard | keda-2.19 | 0 |
| Chainguard | keda-2.19-metrics-apiserver | 0 |
| Chainguard | keda-fips-2.17 | no fix |
| Chainguard | keda-fips-2.17-metrics-apiserver | no fix |
| Chainguard | keda-fips-2.18 | 0 |
| Chainguard | keda-fips-2.18-metrics-apiserver | 0 |
| Chainguard | keda-fips-2.19 | 0 |
| Chainguard | keda-fips-2.19-metrics-apiserver | 0 |
| Chainguard | kine | 0.14.16-r2 |
| Chainguard | kots | 1.130.0-r5 |
| Chainguard | kube-bench | 0 |
| Chainguard | kube-bench-fips | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kuma-cp-2.10 | no fix |
| Chainguard | kuma-cp-2.11 | 0 |
| Chainguard | kuma-cp-2.12 | 0 |
| Chainguard | kuma-cp-2.13 | 0 |
| Chainguard | kuma-cp-2.7 | 0 |
| Chainguard | kuma-cp-2.9 | 0 |
| Chainguard | kuma-dp-2.10 | no fix |
| Chainguard | kuma-dp-2.11 | 0 |
| Chainguard | kuma-dp-2.12 | 0 |
| Chainguard | kuma-dp-2.13 | 0 |
| Chainguard | kuma-dp-2.7 | 0 |
| Chainguard | kuma-dp-2.9 | 0 |
| Chainguard | kumactl-2.10 | no fix |
| Chainguard | kumactl-2.11 | 0 |
| Chainguard | kumactl-2.12 | 0 |
| Chainguard | kumactl-2.13 | 0 |
| Chainguard | kumactl-2.7 | 0 |
| Chainguard | kumactl-2.9 | 0 |
| Chainguard | migrate | 0 |
| Chainguard | openbao | 0 |
| Chainguard | openbao-fips | 0 |
| Chainguard | ory-kratos | 0 |
| Chainguard | ory-kratos-fips | 0 |
| Chainguard | pg_timetable | 0 |
| Chainguard | pg_timetable-fips | 0 |
| Chainguard | pgwatch | 0 |
| Chainguard | rke2-cloud-provider | 0 |
| Chainguard | rke2-cloud-provider-fips | 0 |
| Chainguard | rke2-runtime-1.31 | no fix |
| Chainguard | rke2-runtime-1.32 | no fix |
| Chainguard | rke2-runtime-1.33 | 0 |
| Chainguard | rke2-runtime-1.34 | 0 |
| Chainguard | rke2-runtime-1.35 | 0 |
| Chainguard | rke2-runtime-fips-1.31 | no fix |
| Chainguard | rke2-runtime-fips-1.32 | no fix |
| Chainguard | rke2-runtime-fips-1.33 | 0 |
| Chainguard | rke2-runtime-fips-1.34 | 0 |
| Chainguard | rke2-runtime-fips-1.35 | 0 |
| Chainguard | seaweedfs | 0 |
| Chainguard | seaweedfs-fips | 0 |
| Chainguard | seaweedfs-rocksdb | 0 |
| Chainguard | seaweedfs-rocksdb-fips | 0 |
| Chainguard | sftpgo | 0 |
| Chainguard | sftpgo-plugin-eventsearch | 0 |
| Chainguard | sftpgo-plugin-eventstore | 0 |
| Chainguard | spicedb | 0 |
| Chainguard | spicedb-fips | 0 |
| Chainguard | spire-server | 1.14.5-r1 |
| Chainguard | spire-server-fips | 0 |
| Chainguard | spqr | 0 |
| Chainguard | steampipe | 0 |
| Chainguard | step | 0 |
| Chainguard | step-ca | 0 |
| Chainguard | step-ca-fips | 0 |
| Chainguard | step-fips | 0 |
| Chainguard | step-issuer | 0 |
| Chainguard | step-issuer-fips | 0 |
| Chainguard | teleport-17 | 0 |
| Chainguard | teleport-18 | 0 |
| Chainguard | teleport-18.6 | 0 |
| Chainguard | temporal | 0 |
| Chainguard | temporal-fips | 0 |
| Chainguard | temporal-server | 0 |
| Chainguard | temporal-server-fips | 0 |
| Chainguard | temporal-sql-tool | 0 |
| Chainguard | temporal-sql-tool-fips | 0 |
| Chainguard | timescaledb-parallel-copy | 0 |
| Chainguard | vault-1.20 | no fix |
| Chainguard | vault-1.21 | 0 |
| Chainguard | vault-fips-1.21 | 0 |
| Chainguard | wal-g-pg | 0 |
| Chainguard | zitadel-3 | 0 |
| Debian 14 | golang-github-jackc-pgx-v5 | 5.9.2-1 |
| Red Hat edge manager 1.0 | flightctl | 0:1.0.3-1.el9em |
| Red Hat edge manager 1.0 | flightctl-agent | 0:1.0.3-1.el9em |
| Red Hat edge manager 1.0 | flightctl-cli | 0:1.0.3-1.el9em |
| Red Hat edge manager 1.0 | flightctl-selinux | 0:1.0.3-1.el9em |
| Red Hat edge manager 1.1 | flightctl | 0:1.1.3-1.el9em |
| Red Hat edge manager 1.1 | flightctl | 0:1.1.3-1.el10em |
| Red Hat edge manager 1.1 | flightctl-agent | 0:1.1.3-1.el10em |
| Red Hat edge manager 1.1 | flightctl-agent | 0:1.1.3-1.el9em |
| Red Hat edge manager 1.1 | flightctl-cli | 0:1.1.3-1.el10em |
| Red Hat edge manager 1.1 | flightctl-cli | 0:1.1.3-1.el9em |
| Red Hat Enterprise Linux 10.2 | go-fdo-server | 0:1.0.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | go-fdo-server-debuginfo | 0:1.0.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | go-fdo-server-debugsource | 0:1.0.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | go-fdo-server-manufacturer | 0:1.0.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | go-fdo-server-owner | 0:1.0.1-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | go-fdo-server-rendezvous | 0:1.0.1-1.el10_2 |
| Red Hat hummingbird 1 | go-fdo-server | 0:1.0.1-0.1.hum1 |
| Red Hat hummingbird 1 | go-fdo-server-manufacturer | 0:1.0.1-0.1.hum1 |
| Red Hat hummingbird 1 | go-fdo-server-owner | 0:1.0.1-0.1.hum1 |
| Red Hat hummingbird 1 | go-fdo-server-rendezvous | 0:1.0.1-0.1.hum1 |
| Rocky Linux 10 | go-fdo-server | 0:1.0.1-1.el10_2 |
| Ubuntu 26.04 LTS | golang-github-jackc-pgx-v5 | no fix |
| Ubuntu 26.10 | golang-github-jackc-pgx-v5 | no fix |
| Wolfi | argo-workflow-controller-3.7 | 0 |
| Wolfi | argo-workflow-controller-4.0 | 0 |
| Wolfi | argo-workflow-executor-3.7 | 0 |
| Wolfi | argo-workflow-executor-4.0 | 0 |
| Wolfi | argo-workflows-3.7 | 0 |
| Wolfi | argo-workflows-4.0 | 0 |
| Wolfi | azure-service-operator | 0 |
| Wolfi | bento | 0 |
| Wolfi | caddy | 0 |
| Wolfi | cerbos | 0 |
| Wolfi | certificate-transparency-trillian-ctserver | 0 |
| Wolfi | cloudnative-pg | 0 |
| Wolfi | cloudnative-pg-plugins | 1.29.0-r3 |
| Wolfi | cloudprober | 0 |
| Wolfi | dapr-daprd-1.16 | 0 |
| Wolfi | dapr-daprd-1.17 | 0 |
| Wolfi | envoy-gateway-egctl | 1.7.2-r1 |
| Wolfi | falcosidekick | 0 |
| Wolfi | ferretdb | 0 |
| Wolfi | flyte | 0 |
| Wolfi | gitaly-18.10 | 0 |
| Wolfi | gitaly-18.11 | 0 |
| Wolfi | gitaly-18.6 | no fix |
| Wolfi | gitaly-18.7 | no fix |
| Wolfi | gitaly-18.8 | no fix |
| Wolfi | gitaly-18.9 | 0 |
| Wolfi | gitness | 0 |
| Wolfi | hydra | 0 |
| Wolfi | jitsucom-bulker-bulker | 0 |
| Wolfi | jitsucom-bulker-sidecar | 0 |
| Wolfi | jitsucom-bulker-syncctl | 0 |
| Wolfi | juicefs-1.3 | 0 |
| Wolfi | k3s | 1.35.3.1-r3 |
| Wolfi | k3s-1.32 | 1.32.13.1-r12 |
| Wolfi | k3s-1.33 | 1.33.10.1-r7 |
| Wolfi | k3s-1.34 | 1.34.6.1-r3 |
| Wolfi | k3s-1.35 | 1.35.3.1-r2 |
| Wolfi | k3s-static | 1.35.3.1-r3 |
| Wolfi | k3s-static-1.32 | 1.32.13.1-r12 |
| Wolfi | k3s-static-1.33 | 1.33.10.1-r7 |
| Wolfi | k3s-static-1.34 | 1.34.6.1-r3 |
| Wolfi | k3s-static-1.35 | 1.35.3.1-r2 |
| Wolfi | keda-2.19 | 0 |
| Wolfi | keda-2.19-metrics-apiserver | 0 |
| Wolfi | kine | 0.14.16-r2 |
| Wolfi | kots | 1.130.0-r5 |
| Wolfi | kube-bench | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kuma-cp-2.12 | 0 |
| Wolfi | kuma-cp-2.13 | 0 |
| Wolfi | kuma-dp-2.12 | 0 |
| Wolfi | kuma-dp-2.13 | 0 |
| Wolfi | kumactl-2.12 | 0 |
| Wolfi | kumactl-2.13 | 0 |
| Wolfi | migrate | 0 |
| Wolfi | openbao | 0 |
| Wolfi | pg_timetable | 0 |
| Wolfi | rke2-cloud-provider | 0 |
| Wolfi | seaweedfs | 0 |
| Wolfi | sftpgo | 0 |
| Wolfi | sftpgo-plugin-eventsearch | 0 |
| Wolfi | sftpgo-plugin-eventstore | 0 |
| Wolfi | spicedb | 0 |
| Wolfi | spire-server | 1.14.5-r1 |
| Wolfi | spqr | 0 |
| Wolfi | steampipe | 0 |
| Wolfi | step | 0 |
| Wolfi | step-ca | 0 |
| Wolfi | step-issuer | 0 |
| Wolfi | teleport-18.6 | 0 |
| Wolfi | temporal | 0 |
| Wolfi | temporal-server | 0 |
| Wolfi | temporal-sql-tool | 0 |
| Wolfi | timescaledb-parallel-copy | 0 |
| Wolfi | wal-g-pg | 0 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | kubectl-cnpg | 1.29.1-1.1 |