CVE-2026-41889

A flaw was found in pgx, a PostgreSQL driver and toolkit for Go. This SQL injection vulnerability can occur when using the non-default simple protocol, a dollar-quoted string literal in the SQL query, and when that string literal contains text interpreted as a placeholder with an attacker-controlled value. An attacker could potentially manipulate SQL queries, leading to a low impact on data integrity.

Red Hat has rated this flaw as Moderate because the SQL injection vulnerability in pgx can only be triggered when the non-default simple protocol is used in conjunction with specific query constructions involving PostgreSQL dollar-quoted string literals. Successful exploitation requires multiple uncommon preconditions, including attacker control of placeholder values within affected queries. As the issue is limited to particular application usage patterns and does not affect default pgx configurations, the overall risk is reduced despite the potential for query manipulation in vulnerable applications.The strongest argument for a Moderate rating is that this is not a generic SQL injection affecting all pgx users; it is a narrowly scoped flaw requiring a non-default mode and specific application behavior

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using the non-default simple protocol in applications that use the pgx PostgreSQL driver for Go. The vulnerability is contingent on this non-default protocol and specific SQL query constructs. Configuring applications to use the default extended protocol prevents this issue. If the simple protocol is necessary, ensure that dollar-quoted string literals do not contain attacker-controlled placeholder values.