CVE-2026-32286

CVE-2026-32286 affects components utilizing the DataRow.Decode function, likely within a Go-based PostgreSQL client library, where it fails to properly validate field lengths. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This flaw leads to a slice bounds out of range panic, resulting in a high impact to availability (Denial of Service) for the affected client or application. The CVSSv3.1 score is 7.5 (High), indicating a network-exploitable vulnerability with low attack complexity and no user interaction required. Currently, there is no evidence of active exploitation, nor is public exploit code available on platforms like Metasploit or ExploitDB, and it is not listed on CISA's KEV catalog.