critical
CVE-2026-41889
github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.3CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Red Hat5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), GHSA (low), Azure Linux (low).
Description
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | keda, telegraf | 0:2.14.1-15.azl3 and 1 more |
| chainguard | amass, argo-workflows-3.7, argo-workflows-4.0 and 165 more | 5.1.1-r1 and 138 more |
| debian 14 | golang-github-jackc-pgx-v5 | no fix listed |
| go::GitHub Security Advisory Go | github.com/jackc/pgx, github.com/jackc/pgx/v4, github.com/jackc/pgx/v5 | 5.9.2 |
| minimos | argo-workflows-3.7, argo-workflows-4.0, argo-workflows-fips-3.7 and 79 more | 3.7.14-r0 and 53 more |
| rapidfort alma 10 | go-fdo-server, go-fdo-server-manufacturer, go-fdo-server-owner and 4 more | no fix listed |
| rapidfort alma 8 | osbuild-composer, osbuild-composer-core, osbuild-composer-worker | no fix listed |
| rapidfort alma 9 | osbuild-composer, osbuild-composer-core, osbuild-composer-worker | no fix listed |
| rapidfort fedora 43 | osbuild-composer, osbuild-composer-core, osbuild-composer-worker | 176-2.fc43 |
| rapidfort Oracle Linux 10 | go-fdo-server, go-fdo-server-manufacturer, go-fdo-server-owner and 4 more | no fix listed |
| rapidfort Oracle Linux 9 | osbuild-composer, osbuild-composer-core, osbuild-composer-dnf-json and 1 more | no fix listed |
| rapidfort Red Hat 10 | osbuild-composer, osbuild-composer-core, osbuild-composer-worker | no fix listed |
Show all 388 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | keda | 0:2.14.1-15.azl3 |
| Azure Linux 3.0 | telegraf | 0:1.31.0-22.azl3 |
| chainguard | amass | 5.1.1-r1 |
| chainguard | argo-workflows-3.7 | 3.7.14-r0 |
| chainguard | argo-workflows-4.0 | 4.0.5-r0 |
| chainguard | argo-workflows-fips-3.7 | 3.7.14-r0 |
| chainguard | authentik-2025.12 | 2025.12.4-r6 |
| chainguard | authentik-2026.2 | 2026.2.1-r6 |
| chainguard | authentik-fips-2025.12 | 2025.12.4-r5 |
| chainguard | authentik-fips-2026.2 | 2026.2.1-r5 |
| chainguard | azure-service-operator | 2.18.0-r7 |
| chainguard | azure-service-operator-fips | 2.18.0-r6 |
| chainguard | bento | 1.17.0-r2 |
| chainguard | bento-fips | 1.17.0-r2 |
| chainguard | caddy | 2.11.2-r13 |
| chainguard | caddy-fips | 2.11.2-r9 |
| chainguard | cerbos | 0.51.0-r19 |
| chainguard | certificate-transparency | 1.3.3-r7 |
| chainguard | certificate-transparency-fips | 1.3.3-r7 |
| chainguard | chainloop-control-plane | 1.95.0-r0 |
| chainguard | chainloop-control-plane-fips | 1.94.1-r1 |
| chainguard | cloudnative-pg | 1.29.0-r5 |
| chainguard | cloudnative-pg-fips | 1.29.0-r4 |
| chainguard | cloudprober | 0.14.2-r9 |
| chainguard | cloudprober-fips | 0.14.2-r7 |
| chainguard | commercial-chainloop-backend | 1.72.2-r0 |
| chainguard | commercial-expanso-edge | 2.1.19-r0 |
| chainguard | commercial-grafana-11.6 | 11.6.16-r0 |
| chainguard | commercial-grafana-12.2 | 12.2.10-r0 |
| chainguard | commercial-grafana-12.3 | 12.3.8-r0 |
| chainguard | commercial-grafana-12.4 | 12.4.5-r0 |
| chainguard | dapr-1.14 | 1.14.5-r21 |
| chainguard | dapr-1.15 | 1.15.14-r3 |
| chainguard | dapr-1.16 | 1.16.14-r1 |
| chainguard | dapr-1.17 | 1.17.5-r1 |
| chainguard | dapr-fips-1.14 | 1.14.5-r20 |
| chainguard | dapr-fips-1.15 | 1.15.14-r2 |
| chainguard | dapr-fips-1.16 | 1.16.14-r1 |
| chainguard | dapr-fips-1.17 | 1.17.5-r1 |
| chainguard | envoy-gateway | 1.7.2-r7 |
| chainguard | envoy-gateway-fips | 1.7.2-r4 |
| chainguard | envoy-gateway-fips-1.6 | 1.6.7-r11 |
| chainguard | falcosidekick | 2.33.0-r5 |
| chainguard | falcosidekick-fips | 2.33.0-r4 |
| chainguard | ferretdb | 2.7.0-r15 |
| chainguard | flyte | 1.16.6-r0 |
| chainguard | gitaly-18.10 | 18.10.4-r3 |
| chainguard | gitaly-18.11 | 18.11.2-r2 |
| chainguard | gitaly-18.9 | 18.9.6-r3 |
| chainguard | gitaly-fips-18.10 | 18.10.4-r1 |
| chainguard | gitaly-fips-18.11 | 18.11.2-r3 |
| chainguard | gitaly-fips-18.9 | 18.9.6-r1 |
| chainguard | gitlab-cng-18.10 | 18.10.5-r1 |
| chainguard | gitlab-cng-18.11 | 18.11.2-r1 |
| chainguard | gitlab-cng-18.9 | 18.9.6-r1 |
| chainguard | gitlab-cng-fips-18.10 | 18.10.5-r1 |
| chainguard | gitlab-cng-fips-18.11 | 18.11.2-r1 |
| chainguard | gitlab-cng-fips-18.9 | 18.9.6-r1 |
| chainguard | gitlab-elasticsearch-indexer | 5.14.13-r2 |
| chainguard | gitlab-elasticsearch-indexer-fips | 5.14.13-r2 |
| chainguard | gitlab-kas-18.11 | 18.11.3-r1 |
| chainguard | gitlab-kas-fips-18.11 | 18.11.2-r2 |
| chainguard | gitness | 3.3.0-r14 |
| chainguard | goose | 3.27.0-r6 |
| chainguard | goose-fips | 3.27.0-r6 |
| chainguard | gotrue | 2.191.0-r2 |
| chainguard | gotrue-fips | 2.191.0-r2 |
| chainguard | grafana-11.6 | 11.6.14.01-r10 |
| chainguard | grafana-12.1 | 12.1.10.01-r23 |
| chainguard | grafana-12.2 | 12.2.8.01-r9 |
| chainguard | grafana-12.3 | 12.3.6.01-r3 |
| chainguard | grafana-12.4 | 12.4.2-r10 |
| chainguard | grafana-13.0 | 13.0.1-r2 |
| chainguard | grafana-alloy | 1.17.0-r0 |
| chainguard | grafana-alloy-fips | 1.17.0-r0 |
| chainguard | grafana-fips-11.6 | 11.6.14.01-r4 |
| chainguard | grafana-fips-12.2 | 12.2.8.01-r4 |
| chainguard | grafana-fips-12.3 | 12.3.6.01-r3 |
| chainguard | grafana-fips-12.4 | 12.4.2-r9 |
| chainguard | grafana-fips-13.0 | 13.0.1-r2 |
| chainguard | harbor-2.15 | 2.15.2-r0 |
| chainguard | harbor-fips-2.15 | 2.15.2-r0 |
| chainguard | hydra | 26.2.0-r4 |
| chainguard | hydra-fips | 26.2.0-r4 |
| chainguard | jitsucom-bulker | 2.11.913-r24 |
| chainguard | juicefs-1.2 | 1.2.5-r10 |
| chainguard | juicefs-1.3 | 1.3.1-r13 |
| chainguard | k3s | 1.35.3.1-r6 |
| chainguard | k3s-1.31 | 1.31.6.1-r24 |
| chainguard | k3s-1.32 | 1.32.13.1-r14 |
| chainguard | k3s-1.33 | 1.33.10.1-r9 |
| chainguard | k3s-1.34 | 1.34.8.1-r0 |
| chainguard | k3s-1.35 | 1.35.3.1-r9 |
| chainguard | keda-2.18 | 2.18.3-r10 |
| chainguard | keda-2.19 | 2.19.0-r12 |
| chainguard | keda-fips-2.18 | 2.18.3-r7 |
| chainguard | keda-fips-2.19 | 2.19.0-r6 |
| chainguard | kine | 0.14.16-r3 |
| chainguard | kots | 1.131.3-r0 |
| chainguard | kube-bench | 0.15.0-r8 |
| chainguard | kube-bench-fips | 0.15.0-r6 |
| chainguard | kubeflow-pipelines | 2.16.0-r17 |
| chainguard | kuma-2.11 | 2.11.7-r12 |
| chainguard | kuma-2.12 | 2.12.3-r13 |
| chainguard | kuma-2.13 | 2.13.4-r3 |
| chainguard | kuma-2.7 | 2.7.19-r12 |
| chainguard | kuma-2.9 | 2.9.15-r0 |
| chainguard | ldap2pg | 6.5.1-r1 |
| chainguard | migrate | 4.19.1-r14 |
| chainguard | openbao | 2.5.3-r0 |
| chainguard | openbao-fips | 2.5.3-r0 |
| chainguard | openfga | 1.14.2-r1 |
| chainguard | openfga-fips | 1.14.2-r1 |
| chainguard | opentelemetry-collector-contrib | 0.151.0-r0 |
| chainguard | opentelemetry-collector-contrib-fips | 0.151.0-r0 |
| chainguard | ory-kratos | 26.2.0-r5 |
| chainguard | ory-kratos-fips | 26.2.0-r5 |
| chainguard | peerdb-flow | 0.36.18-r1 |
| chainguard | pg_timetable | 6.3.0-r2 |
| chainguard | pg_timetable-fips | 6.2.0-r8 |
| chainguard | pgwatch | 5.1.0-r4 |
| chainguard | rke2-cloud-provider | 1.35.1-r7 |
| chainguard | rke2-cloud-provider-fips | 1.34.2-r12 |
| chainguard | rke2-runtime-1.33 | 1.33.11.2.1-r1 |
| chainguard | rke2-runtime-1.34 | 1.34.7.2.1-r1 |
| chainguard | rke2-runtime-1.35 | 1.35.3.2.3-r3 |
| chainguard | rke2-runtime-fips-1.33 | 1.33.10.2.3-r2 |
| chainguard | rke2-runtime-fips-1.34 | 1.34.8.2.1-r0 |
| chainguard | rke2-runtime-fips-1.35 | 1.35.5.2.1-r0 |
| chainguard | seaweedfs | 4.22-r0 |
| chainguard | seaweedfs-fips | 4.22-r0 |
| chainguard | seaweedfs-rocksdb | 4.30-r0 |
| chainguard | seaweedfs-rocksdb-fips | 4.30-r0 |
| chainguard | sftpgo | 2.7.1-r9 |
| chainguard | sftpgo-plugin-eventsearch | 1.0.22-r7 |
| chainguard | sftpgo-plugin-eventstore | 1.0.23-r4 |
| chainguard | spicedb | 1.51.1-r1 |
| chainguard | spicedb-fips | 1.51.1-r1 |
| chainguard | spire-server | 1.14.5-r4 |
| chainguard | spire-server-fips | 1.14.5-r3 |
| chainguard | splunk-otel-collector | 0.160.0-r0 |
| chainguard | splunk-otel-collector-fips | 0.154.0-r1 |
| chainguard | spqr | 2.9.9-r0 |
| chainguard | sql_exporter | 0.22.3-r1 |
| chainguard | sql_exporter-fips | 0.22.3-r1 |
| chainguard | src | 7.1.0-r1 |
| chainguard | steampipe | 2.4.1-r4 |
| chainguard | step | 0.30.2-r4 |
| chainguard | step-ca | 0.30.2-r5 |
| chainguard | step-ca-fips | 0.30.2-r5 |
| chainguard | step-fips | 0.30.2-r4 |
| chainguard | step-issuer | 0.10.2-r7 |
| chainguard | step-issuer-fips | 0.10.2-r3 |
| chainguard | telegraf-1.38 | 1.38.3-r2 |
| chainguard | teleport-17 | 17.7.23-r0 |
| chainguard | teleport-18 | 18.7.6-r0 |
| chainguard | temporal | 1.7.0-r0 |
| chainguard | temporal-fips | 1.6.2-r7 |
| chainguard | temporal-server | 1.31.0-r0 |
| chainguard | temporal-server-fips | 1.30.4-r1 |
| chainguard | timescaledb-parallel-copy | 0.12.0-r10 |
| chainguard | trillian | 1.7.3-r5 |
| chainguard | trillian-fips | 1.7.3-r4 |
| chainguard | vault-1.21 | 1.21.4-r12 |
| chainguard | vault-2.0 | 2.0.0-r4 |
| chainguard | vault-fips-1.21 | 1.21.4-r7 |
| chainguard | vault-fips-2.0 | 2.0.0-r4 |
| chainguard | wal-g | 3.0.8-r13 |
| chainguard | zitadel-3 | 3.4.9-r7 |
| chainguard | zitadel-4 | 4.14.0-r0 |
| debian 14 | golang-github-jackc-pgx-v5 | no fix listed |
| go::GitHub Security Advisory Go | github.com/jackc/pgx | no fix listed |
| go::GitHub Security Advisory Go | github.com/jackc/pgx/v4 | no fix listed |
| go::GitHub Security Advisory Go | github.com/jackc/pgx/v5 | 5.9.2 |
| minimos | argo-workflows-3.7 | 3.7.14-r0 |
| minimos | argo-workflows-4.0 | 4.0.5-r0 |
| minimos | argo-workflows-fips-3.7 | 3.7.14-r0 |
| minimos | argo-workflows-fips-4.0 | 4.0.5-r0 |
| minimos | azure-service-operator | 2.19.0-r0 |
| minimos | bento | 1.19.0-r0 |
| minimos | bento-fips | 1.19.0-r0 |
| minimos | caddy | 2.11.3-r0 |
| minimos | caddy-fips | 2.11.2-r8 |
| minimos | cerbos | 0.51.0-r4 |
| minimos | cerbos-fips | 0.51.0-r4 |
| minimos | cloudnative-pg | 1.29.0-r2 |
| minimos | cloudprober | 0.14.3-r0 |
| minimos | dapr-daprd-1.16 | 1.16.17-r0 |
| minimos | dapr-daprd-1.17 | 1.17.10-r2 |
| minimos | dapr-daprd-fips-1.16 | 1.16.17-r0 |
| minimos | dapr-daprd-fips-1.17 | 1.17.10-r1 |
| minimos | falcosidekick | 2.33.0-r6 |
| minimos | falcosidekick-fips | 2.33.0-r7 |
| minimos | flipt-1 | 1.61.1-r6 |
| minimos | flipt-fips-1 | 1.61.1-r5 |
| minimos | gitlab-cng-18.10 | 18.10.8-r1 |
| minimos | gitlab-cng-18.11 | 18.11.5-r1 |
| minimos | gitlab-cng-19.0 | 19.0.4-r1 |
| minimos | gitlab-cng-19.1 | 19.1.1-r2 |
| minimos | gitlab-cng-fips-18.10 | 18.10.8-r1 |
| minimos | gitlab-cng-fips-18.11 | 18.11.5-r1 |
| minimos | gitlab-cng-fips-19.0 | 19.0.4-r1 |
| minimos | gitlab-cng-fips-19.1 | 19.1.0-r1 |
| minimos | gitlab-elasticsearch-indexer | 5.14.10-r1 |
| minimos | gitlab-elasticsearch-indexer-fips | 5.14.10-r2 |
| minimos | grafana-11.6 | 11.6.15-r0 |
| minimos | grafana-12.2 | 12.2.9-r0 |
| minimos | grafana-12.3 | 12.3.7-r0 |
| minimos | grafana-12.4 | 12.4.4-r0 |
| minimos | grafana-13.0 | 13.0.2-r0 |
| minimos | grafana-alloy | 1.17.0-r0 |
| minimos | grafana-alloy-fips | 1.17.0-r0 |
| minimos | grafana-fips-11.6 | 11.6.15-r0 |
| minimos | grafana-fips-12.2 | 12.2.9-r0 |
| minimos | grafana-fips-12.3 | 12.3.7-r0 |
| minimos | grafana-fips-12.4 | 12.4.4-r0 |
| minimos | grafana-fips-13.0 | 13.0.2-r0 |
| minimos | harbor-2.15 | 2.15.2-r0 |
| minimos | harbor-fips-2.15 | 2.15.2-r0 |
| minimos | hydra | 26.2.0-r1 |
| minimos | hydra-fips | 26.2.0-r1 |
| minimos | infisical | 0.43.78-r1 |
| minimos | infisical-fips | 0.43.88-r0 |
| minimos | keda-2.19 | 2.19.0-r10 |
| minimos | keda-fips-2.19 | 2.19.0-r13 |
| minimos | kratos | 26.2.0-r1 |
| minimos | kratos-fips | 26.2.0-r1 |
| minimos | kubeflow-pipelines-apiserver | 2.16.1-r1 |
| minimos | kubeflow-pipelines-apiserver-fips | 2.16.1-r1 |
| minimos | netdata-2.10 | 2.10.3-r2 |
| minimos | netdata-fips-2.10 | 2.10.3-r2 |
| minimos | openbao | 2.5.5-r1 |
| minimos | openbao-fips | 2.5.5-r2 |
| minimos | opentelemetry-collector-contrib | 0.150.0-r2 |
| minimos | opentelemetry-collector-contrib-fips | 0.150.0-r2 |
| minimos | peerdb-flow | 0.36.30-r0 |
| minimos | peerdb-flow-fips | 0.36.30-r0 |
| minimos | pg-timetable | 6.3.0-r1 |
| minimos | pg-timetable-fips | 6.3.0-r1 |
| minimos | signoz | 0.132.1-r0 |
| minimos | signoz-fips | 0.132.2-r0 |
| minimos | spire-server-1.14 | 1.14.7-r1 |
| minimos | spire-server-fips-1.14 | 1.14.7-r1 |
| minimos | teleport-17 | 17.7.23-r0 |
| minimos | teleport-18 | 18.7.6-r0 |
| minimos | teleport-fips-18 | 18.7.6-r0 |
| minimos | temporal | 1.6.2-r7 |
| minimos | temporal-fips | 1.6.2-r8 |
| minimos | temporal-server-1.28 | 1.28.4-r4 |
| minimos | temporal-server-1.29 | 1.29.6.1-r0 |
| minimos | temporal-server-1.30 | 1.30.4.1-r0 |
| minimos | temporal-server-fips-1.28 | 1.28.4-r5 |
| minimos | temporal-server-fips-1.29 | 1.29.6.1-r0 |
| minimos | temporal-server-fips-1.30 | 1.30.4.1-r0 |
| minimos | vault | 2.0.1-r0 |
| minimos | vault-fips | 2.0.1-r0 |
| rapidfort alma 10 | go-fdo-server | no fix listed |
| rapidfort alma 10 | go-fdo-server-manufacturer | no fix listed |
| rapidfort alma 10 | go-fdo-server-owner | no fix listed |
| rapidfort alma 10 | go-fdo-server-rendezvous | no fix listed |
| rapidfort alma 10 | osbuild-composer | no fix listed |
| rapidfort alma 10 | osbuild-composer-core | no fix listed |
| rapidfort alma 10 | osbuild-composer-worker | no fix listed |
| rapidfort alma 8 | osbuild-composer | no fix listed |
| rapidfort alma 8 | osbuild-composer-core | no fix listed |
| rapidfort alma 8 | osbuild-composer-worker | no fix listed |
| rapidfort alma 9 | osbuild-composer | no fix listed |
| rapidfort alma 9 | osbuild-composer-core | no fix listed |
| rapidfort alma 9 | osbuild-composer-worker | no fix listed |
| rapidfort fedora 43 | osbuild-composer | 176-2.fc43 |
| rapidfort fedora 43 | osbuild-composer-core | 176-2.fc43 |
| rapidfort fedora 43 | osbuild-composer-worker | 176-2.fc43 |
| rapidfort Oracle Linux 10 | go-fdo-server | no fix listed |
| rapidfort Oracle Linux 10 | go-fdo-server-manufacturer | no fix listed |
| rapidfort Oracle Linux 10 | go-fdo-server-owner | no fix listed |
| rapidfort Oracle Linux 10 | go-fdo-server-rendezvous | no fix listed |
| rapidfort Oracle Linux 10 | osbuild-composer | no fix listed |
| rapidfort Oracle Linux 10 | osbuild-composer-core | no fix listed |
| rapidfort Oracle Linux 10 | osbuild-composer-worker | no fix listed |
| rapidfort Oracle Linux 9 | osbuild-composer | no fix listed |
| rapidfort Oracle Linux 9 | osbuild-composer-core | no fix listed |
| rapidfort Oracle Linux 9 | osbuild-composer-dnf-json | no fix listed |
| rapidfort Oracle Linux 9 | osbuild-composer-worker | no fix listed |
| rapidfort Red Hat 10 | osbuild-composer | no fix listed |
| rapidfort Red Hat 10 | osbuild-composer-core | no fix listed |
| rapidfort Red Hat 10 | osbuild-composer-worker | no fix listed |
| rapidfort Red Hat 9 | osbuild-composer | no fix listed |
| rapidfort Red Hat 9 | osbuild-composer-core | no fix listed |
| rapidfort Red Hat 9 | osbuild-composer-worker | no fix listed |
| rapidfort rocky 10 | osbuild-composer | no fix listed |
| rapidfort rocky 10 | osbuild-composer-core | no fix listed |
| rapidfort rocky 10 | osbuild-composer-worker | no fix listed |
| rapidfort rocky 8 | osbuild-composer | no fix listed |
| rapidfort rocky 8 | osbuild-composer-core | no fix listed |
| rapidfort rocky 8 | osbuild-composer-worker | no fix listed |
| rapidfort rocky 9 | osbuild-composer | no fix listed |
| rapidfort rocky 9 | osbuild-composer-core | no fix listed |
| rapidfort rocky 9 | osbuild-composer-worker | no fix listed |
| Red Hat | openshift-service-mesh/istio-rhel8-operator | no fix listed |
| Red Hat | openshift4/azure-service-rhel9-operator | no fix listed |
| Red Hat | openshift4/o-cloud-manager-operator-bundle | no fix listed |
| Red Hat | openshift4/o-cloud-manager-rhel9-operator | no fix listed |
| Red Hat | openshift4/oc-mirror-plugin-rhel9 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-api-server-rhel8 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-api-server-rhel9 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-csr-approver-rhel8 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-csr-approver-rhel9 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-node-agent-rhel8 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-node-agent-rhel9 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-orchestrator-rhel8 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-orchestrator-rhel9 | no fix listed |
| Red Hat | openshift4/ose-aws-cluster-api-controllers-rhel9 | no fix listed |
| Red Hat | openshift4/ose-baremetal-installer-rhel9 | no fix listed |
| Red Hat | openshift4/ose-cluster-control-plane-machine-set-rhel9-operator | no fix listed |
| Red Hat | openshift4/ose-installer-rhel9 | no fix listed |
| Red Hat | osbuild-composer | no fix listed |
| Red Hat | osbuild-composer-core | no fix listed |
| Red Hat | osbuild-composer-dnf-json | no fix listed |
| Red Hat | osbuild-composer-worker | no fix listed |
| Red Hat | rhceph/alloy-rhel10 | no fix listed |
| Red Hat | rhceph/grafana-rhel10 | no fix listed |
| Red Hat | rhceph/grafana-rhel9 | no fix listed |
| Red Hat | rhceph/rhceph-6-dashboard-rhel9 | no fix listed |
| wolfi | amass | 5.1.1-r1 |
| wolfi | argo-workflows-3.7 | 3.7.14-r0 |
| wolfi | argo-workflows-4.0 | 4.0.5-r0 |
| wolfi | azure-service-operator | 2.18.0-r7 |
| wolfi | bento | 1.17.0-r2 |
| wolfi | caddy | 2.11.2-r13 |
| wolfi | cerbos | 0.51.0-r19 |
| wolfi | certificate-transparency | 1.3.3-r7 |
| wolfi | cloudnative-pg | 1.29.0-r5 |
| wolfi | cloudprober | 0.14.2-r9 |
| wolfi | dapr-1.17 | 1.17.5-r1 |
| wolfi | envoy-gateway | 1.7.2-r7 |
| wolfi | falcosidekick | 2.33.0-r5 |
| wolfi | ferretdb | 2.7.0-r15 |
| wolfi | flyte | 1.16.6-r0 |
| wolfi | gitaly-18.10 | 18.10.4-r3 |
| wolfi | gitaly-18.11 | 18.11.2-r2 |
| wolfi | gitaly-18.9 | 18.9.6-r3 |
| wolfi | gitlab-kas-18.11 | 18.11.3-r1 |
| wolfi | gitness | 3.3.0-r14 |
| wolfi | grafana-12.3 | 12.3.6.01-r3 |
| wolfi | grafana-12.4 | 12.4.2-r10 |
| wolfi | grafana-13.0 | 13.0.1-r2 |
| wolfi | grafana-alloy | 1.17.0-r0 |
| wolfi | hydra | 26.2.0-r4 |
| wolfi | jitsucom-bulker | 2.11.913-r24 |
| wolfi | juicefs-1.3 | 1.3.1-r13 |
| wolfi | k3s | 1.35.3.1-r6 |
| wolfi | k3s-1.32 | 1.32.13.1-r14 |
| wolfi | k3s-1.33 | 1.33.10.1-r9 |
| wolfi | k3s-1.34 | 1.34.8.1-r0 |
| wolfi | k3s-1.35 | 1.35.3.1-r9 |
| wolfi | keda-2.19 | 2.19.0-r12 |
| wolfi | kine | 0.14.16-r3 |
| wolfi | kots | 1.131.3-r0 |
| wolfi | kube-bench | 0.15.0-r8 |
| wolfi | kubeflow-pipelines | 2.16.0-r17 |
| wolfi | kuma-2.12 | 2.12.3-r13 |
| wolfi | kuma-2.13 | 2.13.4-r3 |
| wolfi | migrate | 4.19.1-r14 |
| wolfi | openbao | 2.5.3-r0 |
| wolfi | openfga | 1.14.2-r1 |
| wolfi | opentelemetry-collector-contrib | 0.151.0-r0 |
| wolfi | pg_timetable | 6.3.0-r2 |
| wolfi | rke2-cloud-provider | 1.35.1-r7 |
| wolfi | seaweedfs | 4.22-r0 |
| wolfi | sftpgo | 2.7.1-r9 |
| wolfi | sftpgo-plugin-eventsearch | 1.0.22-r7 |
| wolfi | sftpgo-plugin-eventstore | 1.0.23-r4 |
| wolfi | spicedb | 1.51.1-r1 |
| wolfi | spire-server | 1.14.5-r4 |
| wolfi | splunk-otel-collector | 0.160.0-r0 |
| wolfi | spqr | 2.9.9-r0 |
| wolfi | sql_exporter | 0.22.3-r1 |
| wolfi | src | 7.1.0-r1 |
| wolfi | steampipe | 2.4.1-r4 |
| wolfi | step | 0.30.2-r4 |
| wolfi | step-ca | 0.30.2-r5 |
| wolfi | step-issuer | 0.10.2-r7 |
| wolfi | telegraf-1.38 | 1.38.3-r2 |
| wolfi | temporal | 1.7.0-r0 |
| wolfi | temporal-server | 1.31.0-r0 |
| wolfi | timescaledb-parallel-copy | 0.12.0-r10 |
| wolfi | trillian | 1.7.3-r5 |
| wolfi | wal-g | 3.0.8-r13 |
References
- https://access.redhat.com/security/cve/CVE-2026-41889
- https://github.com/jackc/pgx
- https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da
- https://github.com/jackc/pgx/releases/tag/v5.9.2
- https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx
- https://nvd.nist.gov/vuln/detail/CVE-2026-41889
- https://www.cve.org/CVERecord?id=CVE-2026-41889