CVE-2024-27304

CVE-2024-27304 is a critical SQL injection vulnerability affecting pgx, a PostgreSQL driver and toolkit for Go, and related pgproto3 projects. An integer overflow allows an attacker to manipulate large query or bind messages (exceeding 4 GB) into multiple messages, leading to SQL injection. With a CVSS score of 9.8 (CRITICAL), this vulnerability can be exploited remotely with low complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential future exploitation.