Vulnerability-Lookup

RHSA-2026:15856

Vulnerability from csaf_redhat - Published: 2026-05-09 14:50 - Updated: 2026-06-27 19:50

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: go-fdo-server: * go-fdo-server-1.0.1-0.2.hum1 (aarch64, x86_64) * go-fdo-server-manufacturer-1.0.1-0.2.hum1 (noarch) * go-fdo-server-owner-1.0.1-0.2.hum1 (noarch) * go-fdo-server-rendezvous-1.0.1-0.2.hum1 (noarch) * go-fdo-server-1.0.1-0.2.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-41889

A flaw was found in pgx, a PostgreSQL driver and toolkit for Go. This SQL injection vulnerability can occur when using the non-default simple protocol, a dollar-quoted string literal in the SQL query, and when that string literal contains text interpreted as a placeholder with an attacker-controlled value. An attacker could potentially manipulate SQL queries, leading to a low impact on data integrity.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:go-fdo-server-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:go-fdo-server-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:go-fdo-server-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:go-fdo-server-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

12 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:15856	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-41889	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-41889	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468307	external
https://www.cve.org/CVERecord?id=CVE-2026-41889	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41889	external
https://github.com/jackc/pgx/commit/60644f84918a8…	external
https://github.com/jackc/pgx/releases/tag/v5.9.2	external
https://github.com/jackc/pgx/security/advisories/…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngo-fdo-server:\n  * go-fdo-server-1.0.1-0.2.hum1 (aarch64, x86_64)\n  * go-fdo-server-manufacturer-1.0.1-0.2.hum1 (noarch)\n  * go-fdo-server-owner-1.0.1-0.2.hum1 (noarch)\n  * go-fdo-server-rendezvous-1.0.1-0.2.hum1 (noarch)\n  * go-fdo-server-1.0.1-0.2.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:15856",
        "url": "https://access.redhat.com/errata/RHSA-2026:15856"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41889",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41889"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_15856.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-06-27T19:50:30+00:00",
      "generator": {
        "date": "2026-06-27T19:50:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.2.6"
        }
      },
      "id": "RHSA-2026:15856",
      "initial_release_date": "2026-05-09T14:50:22+00:00",
      "revision_history": [
        {
          "date": "2026-05-09T14:50:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-19T15:46:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-27T19:50:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-fdo-server-main@aarch64",
                "product": {
                  "name": "go-fdo-server-main@aarch64",
                  "product_id": "go-fdo-server-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-fdo-server@1.0.1-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-fdo-server-main@src",
                "product": {
                  "name": "go-fdo-server-main@src",
                  "product_id": "go-fdo-server-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-fdo-server@1.0.1-0.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-fdo-server-main@x86_64",
                "product": {
                  "name": "go-fdo-server-main@x86_64",
                  "product_id": "go-fdo-server-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-fdo-server@1.0.1-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-fdo-server-main@noarch",
                "product": {
                  "name": "go-fdo-server-main@noarch",
                  "product_id": "go-fdo-server-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-fdo-server-manufacturer@1.0.1-0.2.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-fdo-server-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:go-fdo-server-main@aarch64"
        },
        "product_reference": "go-fdo-server-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-fdo-server-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:go-fdo-server-main@noarch"
        },
        "product_reference": "go-fdo-server-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-fdo-server-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:go-fdo-server-main@src"
        },
        "product_reference": "go-fdo-server-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-fdo-server-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:go-fdo-server-main@x86_64"
        },
        "product_reference": "go-fdo-server-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41889",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2026-05-08T17:01:09.435496+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2468307"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pgx, a PostgreSQL driver and toolkit for Go. This SQL injection vulnerability can occur when using the non-default simple protocol, a dollar-quoted string literal in the SQL query, and when that string literal contains text interpreted as a placeholder with an attacker-controlled value. An attacker could potentially manipulate SQL queries, leading to a low impact on data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this flaw as Moderate because the SQL injection vulnerability in pgx can only be triggered when the non-default simple protocol is used in conjunction with specific query constructions involving PostgreSQL dollar-quoted string literals. Successful exploitation requires multiple uncommon preconditions, including attacker control of placeholder values within affected queries. As the issue is limited to particular application usage patterns and does not affect default pgx configurations, the overall risk is reduced despite the potential for query manipulation in vulnerable applications.The strongest argument for a Moderate rating is that this is not a generic SQL injection affecting all pgx users; it is a narrowly scoped flaw requiring a non-default mode and specific application behavior",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:go-fdo-server-main@aarch64",
          "Red Hat Hardened Images:go-fdo-server-main@noarch",
          "Red Hat Hardened Images:go-fdo-server-main@src",
          "Red Hat Hardened Images:go-fdo-server-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41889"
        },
        {
          "category": "external",
          "summary": "RHBZ#2468307",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468307"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41889",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41889"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41889",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41889"
        },
        {
          "category": "external",
          "summary": "https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da",
          "url": "https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da"
        },
        {
          "category": "external",
          "summary": "https://github.com/jackc/pgx/releases/tag/v5.9.2",
          "url": "https://github.com/jackc/pgx/releases/tag/v5.9.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx",
          "url": "https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx"
        }
      ],
      "release_date": "2026-05-08T15:53:00.251000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-09T14:50:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:go-fdo-server-main@aarch64",
            "Red Hat Hardened Images:go-fdo-server-main@noarch",
            "Red Hat Hardened Images:go-fdo-server-main@src",
            "Red Hat Hardened Images:go-fdo-server-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:15856"
        },
        {
          "category": "workaround",
          "details": "Avoid using the non-default simple protocol in applications that use the pgx PostgreSQL driver for Go. The vulnerability is contingent on this non-default protocol and specific SQL query constructs. Configuring applications to use the default extended protocol prevents this issue. If the simple protocol is necessary, ensure that dollar-quoted string literals do not contain attacker-controlled placeholder values.",
          "product_ids": [
            "Red Hat Hardened Images:go-fdo-server-main@aarch64",
            "Red Hat Hardened Images:go-fdo-server-main@noarch",
            "Red Hat Hardened Images:go-fdo-server-main@src",
            "Red Hat Hardened Images:go-fdo-server-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:go-fdo-server-main@aarch64",
            "Red Hat Hardened Images:go-fdo-server-main@noarch",
            "Red Hat Hardened Images:go-fdo-server-main@src",
            "Red Hat Hardened Images:go-fdo-server-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions"
    }
  ]
}

CVE-2026-41889 (GCVE-0-2026-41889)

Vulnerability from cvelistv5 – Published: 2026-05-08 15:53 – Updated: 2026-05-08 19:38

Title

pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Summary

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/jackc/pgx/security/advisories/…	x_refsource_CONFIRM
https://github.com/jackc/pgx/commit/60644f84918a8…	x_refsource_MISC
https://github.com/jackc/pgx/releases/tag/v5.9.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jackc	pgx	Affected: < 5.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41889",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T19:38:09.336936Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T19:38:34.153Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pgx",
          "vendor": "jackc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T15:53:00.251Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwx"
        },
        {
          "name": "https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955da"
        },
        {
          "name": "https://github.com/jackc/pgx/releases/tag/v5.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jackc/pgx/releases/tag/v5.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-j88v-2chj-qfwx",
        "discovery": "UNKNOWN"
      },
      "title": "pgx: SQL Injection via placeholder confusion with dollar quoted string literals"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41889",
    "datePublished": "2026-05-08T15:53:00.251Z",
    "dateReserved": "2026-04-22T15:11:54.671Z",
    "dateUpdated": "2026-05-08T19:38:34.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:15856

CVE-2026-41889 (GCVE-0-2026-41889)

Tags

Sightings

Nomenclature