data/reports: review 8 reports - data/reports/GO-2026-6115.yaml - data/reports/GO-2026-6166.yaml - data/reports/GO-2026-6168.yaml - data/reports/GO-2026-6169.yaml - data/reports/GO-2026-6170.yaml - data/reports/GO-2026-6171.yaml - data/reports/GO-2026-6172.yaml - data/reports/GO-2026-6173.yaml Fixes golang/vulndb#6115 Fixes golang/vulndb#6166 Fixes golang/vulndb#6168 Fixes golang/vulndb#6169 Fixes golang/vulndb#6170 Fixes golang/vulndb#6171 Fixes golang/vulndb#6172 Fixes golang/vulndb#6173 Change-Id: I3774d869689421c7b690f9a73d15735dd0fdba01 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/817280 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Neal Patel <nealpatel@google.com> Auto-Submit: Nicholas Husin <nsh@golang.org> Reviewed-by: Adam Shannon <adamkshannon@gmail.com>
diff --git a/data/osv/GO-2026-6115.json b/data/osv/GO-2026-6115.json index e985817..b4d1acb 100644 --- a/data/osv/GO-2026-6115.json +++ b/data/osv/GO-2026-6115.json
@@ -3,15 +3,16 @@ "id": "GO-2026-6115", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:22:32Z", "aliases": [ "CVE-2026-56867" ], - "summary": "Multiple denial of service vulnerabilities in rsc.io/pdf and forks", - "details": "The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:\n\n- Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics.\n- Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString.\n- Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow.\n- Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).", + "summary": "WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks", + "details": "(This report has been withdrawn with reason: \"Requesting a CVE ID via the Go CNA as part of this report\"). The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:\n\n- Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics.\n- Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString.\n- Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow.\n- Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).", "affected": [ { "package": { - "name": "rsc.io/pdf", + "name": "github.com/dslipak/pdf", "ecosystem": "Go" }, "ranges": [ @@ -27,7 +28,7 @@ "ecosystem_specific": { "imports": [ { - "path": "rsc.io/pdf", + "path": "github.com/dslipak/pdf", "symbols": [ "NewReader", "NewReaderEncrypted", @@ -75,7 +76,7 @@ }, { "package": { - "name": "github.com/dslipak/pdf", + "name": "rsc.io/pdf", "ecosystem": "Go" }, "ranges": [ @@ -91,7 +92,7 @@ "ecosystem_specific": { "imports": [ { - "path": "github.com/dslipak/pdf", + "path": "rsc.io/pdf", "symbols": [ "NewReader", "NewReaderEncrypted", @@ -110,20 +111,20 @@ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56867" }, { + "type": "FIX", + "url": "https://github.com/ledongthuc/pdf/pull/78" + }, + { "type": "REPORT", "url": "https://github.com/golang/vulndb/issues/6115" }, { "type": "WEB", - "url": "https://github.com/ledongthuc/pdf/pull/78" + "url": "https://github.com/dslipak/pdf" }, { "type": "WEB", "url": "https://github.com/rsc/pdf" - }, - { - "type": "WEB", - "url": "https://github.com/dslipak/pdf" } ], "credits": [
diff --git a/data/osv/GO-2026-6166.json b/data/osv/GO-2026-6166.json index c3db2b4..c1381c8 100644 --- a/data/osv/GO-2026-6166.json +++ b/data/osv/GO-2026-6166.json
@@ -3,11 +3,12 @@ "id": "GO-2026-6166", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:22:36Z", "aliases": [ "CVE-2026-56868" ], - "summary": "GSS authentication completes without mutual proof in github.com/lib/pq", - "details": "github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS token and stores the provider, but it tracks neither whether a continuation occurred nor the provider's done result. The startup loop then accepts AuthenticationOk and completes the connection. The continuation branch also discards provider errors and can proceed after failed mutual authentication.", + "summary": "WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq", + "details": "(This report has been withdrawn with reason: \"False positive\"). github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS token and stores the provider, but it tracks neither whether a continuation occurred nor the provider's done result. The startup loop then accepts AuthenticationOk and completes the connection. The continuation branch also discards provider errors and can proceed after failed mutual authentication.", "affected": [ { "package": {
diff --git a/data/osv/GO-2026-6168.json b/data/osv/GO-2026-6168.json index 0a21004..ac10e3b 100644 --- a/data/osv/GO-2026-6168.json +++ b/data/osv/GO-2026-6168.json
@@ -3,11 +3,12 @@ "id": "GO-2026-6168", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:22:41Z", "aliases": [ "CVE-2026-56869" ], - "summary": "Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram", - "details": "The SCRAM client in github.com/lib/pq/scram accepts an attacker-controlled iteration count with no upper bound and immediately performs that many PBKDF2-style HMAC rounds. A PostgreSQL endpoint or active network attacker can send a valid SCRAM server-first message with a large iteration count (such as i=2147483647), causing client authentication to consume excessive CPU resources before verifying the server signature.", + "summary": "WITHDRAWN: Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram", + "details": "(This report has been withdrawn with reason: \"False positive\"). The SCRAM client in github.com/lib/pq/scram accepts an attacker-controlled iteration count with no upper bound and immediately performs that many PBKDF2-style HMAC rounds. A PostgreSQL endpoint or active network attacker can send a valid SCRAM server-first message with a large iteration count (such as i=2147483647), causing client authentication to consume excessive CPU resources before verifying the server signature.", "affected": [ { "package": {
diff --git a/data/osv/GO-2026-6169.json b/data/osv/GO-2026-6169.json index 0994a0a..d5e89c1 100644 --- a/data/osv/GO-2026-6169.json +++ b/data/osv/GO-2026-6169.json
@@ -3,11 +3,12 @@ "id": "GO-2026-6169", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:22:44Z", "aliases": [ "CVE-2026-56870" ], - "summary": "Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq", - "details": "When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost and the remote address, the driver selects the secret intended for the local database and sends it to the remote endpoint when that endpoint requests password authentication.", + "summary": "WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq", + "details": "(This report has been withdrawn with reason: \"False positive\"). When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost and the remote address, the driver selects the secret intended for the local database and sends it to the remote endpoint when that endpoint requests password authentication.", "affected": [ { "package": {
diff --git a/data/osv/GO-2026-6170.json b/data/osv/GO-2026-6170.json index 211000c..8494594 100644 --- a/data/osv/GO-2026-6170.json +++ b/data/osv/GO-2026-6170.json
@@ -3,11 +3,12 @@ "id": "GO-2026-6170", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:22:49Z", "aliases": [ "CVE-2026-56871" ], - "summary": "Malformed backend frame length causes panic in github.com/lib/pq", - "details": "github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose length is zero through three produces a negative payload length. recvMessage then slices the connection scratch buffer with that negative bound, causing an unrecovered runtime panic that terminates the calling goroutine and process.", + "summary": "WITHDRAWN: Malformed backend frame length causes panic in github.com/lib/pq", + "details": "(This report has been withdrawn with reason: \"False positive\"). github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose length is zero through three produces a negative payload length. recvMessage then slices the connection scratch buffer with that negative bound, causing an unrecovered runtime panic that terminates the calling goroutine and process.", "affected": [ { "package": {
diff --git a/data/osv/GO-2026-6171.json b/data/osv/GO-2026-6171.json index ad21f5f..bc9b224 100644 --- a/data/osv/GO-2026-6171.json +++ b/data/osv/GO-2026-6171.json
@@ -3,11 +3,12 @@ "id": "GO-2026-6171", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:22:53Z", "aliases": [ "CVE-2026-56872" ], - "summary": "Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq", - "details": "github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send malformed row responses, causing unrecovered runtime panics while reading query results.", + "summary": "WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq", + "details": "(This report has been withdrawn with reason: \"False positive\"). github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send malformed row responses, causing unrecovered runtime panics while reading query results.", "affected": [ { "package": {
diff --git a/data/osv/GO-2026-6172.json b/data/osv/GO-2026-6172.json index 1d74591..87b779a 100644 --- a/data/osv/GO-2026-6172.json +++ b/data/osv/GO-2026-6172.json
@@ -3,11 +3,12 @@ "id": "GO-2026-6172", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:22:58Z", "aliases": [ "CVE-2026-56873" ], - "summary": "Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq", - "details": "github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active network attacker on an unauthenticated connection can send frame headers declaring multi-gigabyte or invalid-phase payloads, forcing large allocations that lead to memory exhaustion and runtime out-of-memory crashes.", + "summary": "WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq", + "details": "(This report has been withdrawn with reason: \"False positive\"). github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active network attacker on an unauthenticated connection can send frame headers declaring multi-gigabyte or invalid-phase payloads, forcing large allocations that lead to memory exhaustion and runtime out-of-memory crashes.", "affected": [ { "package": {
diff --git a/data/osv/GO-2026-6173.json b/data/osv/GO-2026-6173.json index cb9bad8..550c39f 100644 --- a/data/osv/GO-2026-6173.json +++ b/data/osv/GO-2026-6173.json
@@ -3,11 +3,12 @@ "id": "GO-2026-6173", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", + "withdrawn": "2026-08-18T20:23:02Z", "aliases": [ "CVE-2026-56874" ], - "summary": "Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq", - "details": "The special-case parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls bufio.Reader.ReadString(0) without a byte limit. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send an error message response with non-NUL bytes continuously, causing the client to buffer an arbitrarily large string and crash with an unrecoverable out-of-memory error.", + "summary": "WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq", + "details": "(This report has been withdrawn with reason: \"False positive\"). The special-case parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls bufio.Reader.ReadString(0) without a byte limit. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send an error message response with non-NUL bytes continuously, causing the client to buffer an arbitrarily large string and crash with an unrecoverable out-of-memory error.", "affected": [ { "package": {
diff --git a/data/reports/GO-2026-6115.yaml b/data/reports/GO-2026-6115.yaml index a4a9e85..7039aa0 100644 --- a/data/reports/GO-2026-6115.yaml +++ b/data/reports/GO-2026-6115.yaml
@@ -1,16 +1,16 @@ id: GO-2026-6115 modules: - - module: rsc.io/pdf - vulnerable_at: 0.1.1 + - module: github.com/dslipak/pdf + vulnerable_at: 0.0.2 packages: - - package: rsc.io/pdf + - package: github.com/dslipak/pdf symbols: - Open - NewReader - NewReaderEncrypted - Reader.Page - Page.Content - skip_fix: repository is archived + skip_fix: no fix available - module: github.com/ledongthuc/pdf vulnerable_at: 0.0.0-20250511090121-5959a4027728 packages: @@ -26,43 +26,45 @@ - Page.GetTextByColumn - Page.GetTextByRow skip_fix: no fix available - - module: github.com/dslipak/pdf - vulnerable_at: 0.0.2 + - module: rsc.io/pdf + vulnerable_at: 0.1.1 packages: - - package: github.com/dslipak/pdf + - package: rsc.io/pdf symbols: - Open - NewReader - NewReaderEncrypted - Reader.Page - Page.Content - skip_fix: no fix available -summary: Multiple denial of service vulnerabilities in rsc.io/pdf and forks + skip_fix: repository is archived +summary: 'WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks' description: |- - The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf - and github.com/dslipak/pdf contains multiple defects when parsing untrusted - input: + (This report has been withdrawn with reason: "Requesting a CVE ID via the Go CNA + as part of this report"). The PDF parser in rsc.io/pdf and its downstream forks + github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects + when parsing untrusted input: - Unchecked /Size, /Index, /W, and classic subsection header parameters in - cross-reference tables allow crafted values to trigger fatal out-of-memory - (OOM) panics. + cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) + panics. - Unterminated hexadecimal strings cause an infinite loop in readByte and - readHexString. - - Cyclic object references (/First, /Parent, /Kids, /Next) in document - outlines cause unbounded recursion leading to uncatchable stack overflow. + readHexString. + - Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines + cause unbounded recursion leading to uncatchable stack overflow. - Various malformed constructs trigger runtime panics in NewReader and - Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, - odd-length UTF-16 strings, and newline buffer underflows). + Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, + odd-length UTF-16 strings, and newline buffer underflows). +withdrawn: "2026-08-18T20:22:32Z" cves: - CVE-2026-56867 credits: - Gage Marshall references: - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56867 + - fix: https://github.com/ledongthuc/pdf/pull/78 - report: https://github.com/golang/vulndb/issues/6115 - - web: https://github.com/ledongthuc/pdf/pull/78 - - web: https://github.com/rsc/pdf - web: https://github.com/dslipak/pdf + - web: https://github.com/rsc/pdf source: id: go-security-team created: 2026-08-17T23:16:17.02638-04:00
diff --git a/data/reports/GO-2026-6166.yaml b/data/reports/GO-2026-6166.yaml index b266298..924266e 100644 --- a/data/reports/GO-2026-6166.yaml +++ b/data/reports/GO-2026-6166.yaml
@@ -15,16 +15,19 @@ - NewDialListener - NewListener - NewListenerConn -summary: GSS authentication completes without mutual proof in github.com/lib/pq +summary: |- + WITHDRAWN: GSS authentication completes without mutual proof in + github.com/lib/pq description: |- + (This report has been withdrawn with reason: "False positive"). github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an - unauthenticated peer requests GSS authentication, the driver sends its - initial GSS token and stores the provider, but it tracks neither whether - a continuation occurred nor the provider's done result. The startup loop - then accepts AuthenticationOk and completes the connection. The continuation - branch also discards provider errors and can proceed after failed mutual - authentication. + unauthenticated peer requests GSS authentication, the driver sends its initial + GSS token and stores the provider, but it tracks neither whether a continuation + occurred nor the provider's done result. The startup loop then accepts + AuthenticationOk and completes the connection. The continuation branch also + discards provider errors and can proceed after failed mutual authentication. +withdrawn: "2026-08-18T20:22:36Z" cves: - CVE-2026-56868 references:
diff --git a/data/reports/GO-2026-6168.yaml b/data/reports/GO-2026-6168.yaml index a36d48d..72a0157 100644 --- a/data/reports/GO-2026-6168.yaml +++ b/data/reports/GO-2026-6168.yaml
@@ -10,15 +10,17 @@ - Client.Step - NewClient summary: |- - Unbounded iteration count causes CPU denial of service in + WITHDRAWN: Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram description: |- - The SCRAM client in github.com/lib/pq/scram accepts an attacker-controlled - iteration count with no upper bound and immediately performs that many - PBKDF2-style HMAC rounds. A PostgreSQL endpoint or active network attacker - can send a valid SCRAM server-first message with a large iteration count - (such as i=2147483647), causing client authentication to consume excessive - CPU resources before verifying the server signature. + (This report has been withdrawn with reason: "False positive"). The SCRAM client + in github.com/lib/pq/scram accepts an attacker-controlled iteration count with + no upper bound and immediately performs that many PBKDF2-style HMAC rounds. A + PostgreSQL endpoint or active network attacker can send a valid SCRAM + server-first message with a large iteration count (such as i=2147483647), + causing client authentication to consume excessive CPU resources before + verifying the server signature. +withdrawn: "2026-08-18T20:22:41Z" cves: - CVE-2026-56869 references:
diff --git a/data/reports/GO-2026-6169.yaml b/data/reports/GO-2026-6169.yaml index faac796..5899d4c 100644 --- a/data/reports/GO-2026-6169.yaml +++ b/data/reports/GO-2026-6169.yaml
@@ -16,15 +16,17 @@ - NewListener - NewListenerConn summary: |- - Disclosure of wrong .pgpass credential via hostaddr in + WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq description: |- - When a connection specifies hostaddr without host, github.com/lib/pq dials the - numeric hostaddr but performs .pgpass lookup using the default Config.Host - value, localhost. If the passfile contains different credentials for localhost - and the remote address, the driver selects the secret intended for the local - database and sends it to the remote endpoint when that endpoint requests - password authentication. + (This report has been withdrawn with reason: "False positive"). When a + connection specifies hostaddr without host, github.com/lib/pq dials the numeric + hostaddr but performs .pgpass lookup using the default Config.Host value, + localhost. If the passfile contains different credentials for localhost and the + remote address, the driver selects the secret intended for the local database + and sends it to the remote endpoint when that endpoint requests password + authentication. +withdrawn: "2026-08-18T20:22:44Z" cves: - CVE-2026-56870 references:
diff --git a/data/reports/GO-2026-6170.yaml b/data/reports/GO-2026-6170.yaml index 205d1c1..fd8bb4e 100644 --- a/data/reports/GO-2026-6170.yaml +++ b/data/reports/GO-2026-6170.yaml
@@ -34,14 +34,16 @@ - stmt.ExecContext - stmt.Query - stmt.QueryContext -summary: Malformed backend frame length causes panic in github.com/lib/pq +summary: 'WITHDRAWN: Malformed backend frame length causes panic in github.com/lib/pq' description: |- + (This report has been withdrawn with reason: "False positive"). github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend - frame and subtracts four without first checking that the wire length is at - least four. A backend frame whose length is zero through three produces a - negative payload length. recvMessage then slices the connection scratch buffer - with that negative bound, causing an unrecovered runtime panic that terminates - the calling goroutine and process. + frame and subtracts four without first checking that the wire length is at least + four. A backend frame whose length is zero through three produces a negative + payload length. recvMessage then slices the connection scratch buffer with that + negative bound, causing an unrecovered runtime panic that terminates the calling + goroutine and process. +withdrawn: "2026-08-18T20:22:49Z" cves: - CVE-2026-56871 references:
diff --git a/data/reports/GO-2026-6171.yaml b/data/reports/GO-2026-6171.yaml index 97a3b5d..a1fe0ef 100644 --- a/data/reports/GO-2026-6171.yaml +++ b/data/reports/GO-2026-6171.yaml
@@ -19,14 +19,16 @@ - conn.Ping - rows.Close summary: |- - Malformed RowDescription and DataRow messages cause panics in + WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq description: |- + (This report has been withdrawn with reason: "False positive"). github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send malformed row responses, causing unrecovered runtime panics while reading query results. +withdrawn: "2026-08-18T20:22:53Z" cves: - CVE-2026-56872 references:
diff --git a/data/reports/GO-2026-6172.yaml b/data/reports/GO-2026-6172.yaml index 4d9ec1f..731719b 100644 --- a/data/reports/GO-2026-6172.yaml +++ b/data/reports/GO-2026-6172.yaml
@@ -36,15 +36,17 @@ - stmt.Query - stmt.QueryContext summary: |- - Backend frame lengths cause pre-validation memory exhaustion in + WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq description: |- - github.com/lib/pq allocates the backend-declared PostgreSQL frame payload - before applying a protocol length bound or a phase-specific message-type - check. A malicious server or active network attacker on an unauthenticated - connection can send frame headers declaring multi-gigabyte or invalid-phase - payloads, forcing large allocations that lead to memory exhaustion and runtime - out-of-memory crashes. + (This report has been withdrawn with reason: "False positive"). + github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before + applying a protocol length bound or a phase-specific message-type check. A + malicious server or active network attacker on an unauthenticated connection can + send frame headers declaring multi-gigabyte or invalid-phase payloads, forcing + large allocations that lead to memory exhaustion and runtime out-of-memory + crashes. +withdrawn: "2026-08-18T20:22:58Z" cves: - CVE-2026-56873 references:
diff --git a/data/reports/GO-2026-6173.yaml b/data/reports/GO-2026-6173.yaml index 626ffd4..29b36a8 100644 --- a/data/reports/GO-2026-6173.yaml +++ b/data/reports/GO-2026-6173.yaml
@@ -35,15 +35,16 @@ - stmt.Query - stmt.QueryContext summary: |- - Pre-protocol error reader permits unbounded memory consumption in + WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq description: |- - The special-case parser for PostgreSQL pre-protocol plain-text errors in - github.com/lib/pq calls bufio.Reader.ReadString(0) without a byte limit. A - malicious PostgreSQL endpoint or active network attacker on an unauthenticated - transport can send an error message response with non-NUL bytes continuously, - causing the client to buffer an arbitrarily large string and crash with an - unrecoverable out-of-memory error. + (This report has been withdrawn with reason: "False positive"). The special-case + parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls + bufio.Reader.ReadString(0) without a byte limit. A malicious PostgreSQL endpoint + or active network attacker on an unauthenticated transport can send an error + message response with non-NUL bytes continuously, causing the client to buffer + an arbitrarily large string and crash with an unrecoverable out-of-memory error. +withdrawn: "2026-08-18T20:23:02Z" cves: - CVE-2026-56874 references: