CVE-2024-27304
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2024-27304 is a vulnerability affecting the pgx PostgreSQL driver and toolkit for Go. An attacker can exploit SQL injection by causing a query or bind message size to exceed 4 GB, resulting in integer overflow and the message being split into multiple messages under the attacker's control. This issue can lead to unintended database queries or data access. The vulnerability is addressed in versions 4.18.2 and 5.5.4. As a temporary solution, administrators are advised to reject user input that can cause a single query or bind message to exceed a 4 GB size limit.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions