StackRadar

CVE-2024-27304

Critical

Advisory

Published 4 Mar 2024In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.011
64th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
131
of 17,781 indexed, latest versions
Container images
125
deployed by those charts
Fix available
4 of 4
affected packages

pgproto3 SQL Injection via Protocol Message Size Overflow

Carried by container images the latest versions of 131 of 17,781 indexed charts deploy, on 125 images.

Affected packageAffected versionsFixed inImages
github.com/jackc/pgproto3/v2golangv2.0.0, v2.0.1, v2.0.2, v2.0.4+8 more2.3.397
github.com/jackc/pgx/v4golangv4.6.0, v4.7.1, v4.8.1, v4.8.2-0.20200910143026-040df1ccef85+12 more4.18.289
github.com/jackc/pgx/v5golangv5.0.4, v5.2.0, v5.3.0, v5.3.1+4 more5.5.423
github.com/jackc/pgxgolangv3.1.1-0.20180608201956-39bbc98d99d7+incompatible, v3.2.0+incompatible, v3.3.0+incompatible, v3.6.0+incompatible+1 more4.18.216
OSV records
GHSA-7jwh-3vrq-q3m8GHSA-mrww-27vc-gghv
Also known as
GO-2024-2606

Charts affected

131 by stars
ChartLatestAffected imagesRadar Score
sshportalmidokura-communityVerified publisher0.1.41 of 2See more

sshportal midokura-community 0.1.4

1 of the 2 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
moul/sshportal:v1.19.3332b603727c3
github.com/jackc/pgproto3/v2@v2.2.0
github.com/jackc/pgx/v4@v4.14.0
2.3.3
4.18.2

Open the chart page →

2,338
cockroachdb-operatormmontesVerified publisher0.1.01 of 1See more

cockroachdb-operator mmontes 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
cockroachdb/cockroach-operator:v2.1.0983312754620
github.com/jackc/pgproto3/v2@v2.0.4
github.com/jackc/pgx@v3.6.2+incompatible
2.3.3
4.18.2

Open the chart page →

7,775
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

7,309
iamdnetsocVerified publisher0.6.11 of 2See more

iamd netsoc 0.6.1

1 of the 2 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
ghcr.io/netsoc/iamd:1.1.22fe6b69b20d7
github.com/jackc/pgproto3/v2@v2.0.6
github.com/jackc/pgx/v4@v4.10.1
2.3.3
4.18.2

Open the chart page →

2,890
cloudnative-pgnineinfra-charts0.19.11 of 1See more

cloudnative-pg nineinfra-charts 0.19.1

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.21.19f707d91de1c
github.com/jackc/pgx/v5@v5.4.3
5.5.4

Open the chart page →

1,187
vault-helm-chartnotesprojectchart0.1.01 of 1See more

vault-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
library/vault:1.13.3f98ac9dd97b0
github.com/jackc/pgproto3/v2@v2.2.0
github.com/jackc/pgx@v3.3.0+incompatible
github.com/jackc/pgx/v4@v4.15.0
2.3.3
4.18.2
4.18.2

Open the chart page →

2,246
one-green-coreone-green-coreVerified publisher0.0.71 of 8See more

one-green-core one-green-core 0.0.7

1 of the 8 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
library/telegraf:1.20.428e98eece020
github.com/jackc/pgproto3/v2@v2.0.1
github.com/jackc/pgx/v4@v4.6.0
2.3.3
4.18.2

Open the chart page →

9,558
postgres-connectoropenfaas0.1.21 of 1See more

postgres-connector openfaas 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
ghcr.io/openfaasltd/postgres-connector:0.2.3379e583a0a75
github.com/jackc/pgx@v3.6.2+incompatible
4.18.2

Open the chart page →

1,070
gitlab-proxyopslevelVerified publisher0.0.81 of 1See more

gitlab-proxy opslevel 0.0.8

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
library/caddy:2.660fb54d36b4b
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.2
2.3.3
4.18.2

Open the chart page →

1,872
hydraradar-baseVerified publisher0.48.01 of 1See more

hydra radar-base 0.48.0

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
oryd/hydra:v2.2.02c93beb5e5f2
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

1,524
kratosradar-baseVerified publisher0.43.11 of 1See more

kratos radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
oryd/kratos:v1.1.08f15006a080d
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.2
2.3.3
4.18.2

Open the chart page →

1,776
regoregoOfficialVerified publisher0.1.31 of 1See more

rego rego 0.1.3

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
drorivry4/rego:lateste035d49b15ca
github.com/jackc/pgx/v5@v5.4.3
5.5.4

Open the chart page →

2,919
reportportalreportportal5.7.21 of 8See more

reportportal reportportal 5.7.2

1 of the 8 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
reportportal/migrations:5.7.0da5d8e1395fe
github.com/jackc/pgx@v3.2.0+incompatible
4.18.2

Open the chart page →

25,737
clairromholdings0.1.141 of 2See more

clair romholdings 0.1.14

1 of the 2 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
quay.io/devtron/clair:4.3.675fb847ac045
github.com/jackc/pgproto3/v2@v2.1.1
github.com/jackc/pgx/v4@v4.13.0
2.3.3
4.18.2

Open the chart page →

6,237
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
github.com/jackc/pgx/v5@v5.3.1
2.3.3
4.18.2
5.5.4

Open the chart page →

68,240
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
github.com/jackc/pgx/v5@v5.3.1
2.3.3
4.18.2
5.5.4

Open the chart page →

32,902
controllerrookout0.2.561 of 1See more

controller rookout 0.2.56

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
rookout/controller:latest4451a6f6b8ec
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

1,960
datastorerookout0.1.481 of 1See more

datastore rookout 0.1.48

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
rookout/data-on-prem:latest51c0fce64467
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

1,941
rookout-hybridrookout0.3.12 of 2See more

rookout-hybrid rookout 0.3.1

2 of the 2 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
rookout/controller:latest4451a6f6b8ec
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
rookout/data-on-prem:latest51c0fce64467
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

3,901
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

1,721
apache-shardingsphere-operator-chartsshardingsphere0.3.01 of 2See more

apache-shardingsphere-operator-charts shardingsphere 0.3.0

1 of the 2 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
apache/shardingsphere-operator:0.3.0ffe68d6b99c0
github.com/jackc/pgx/v5@v5.3.1
5.5.4

Open the chart page →

1,698
bytesafe-cesimcube1.0.41 of 3See more

bytesafe-ce simcube 1.0.4

1 of the 3 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
bytesafe/bytesafe-ce:v1.0.4ee287384c005
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

1,494
harborsoftonic1.13.03 of 8See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.9.06412d679fdc3
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
goharbor/harbor-jobservice:v2.9.039435daedd0c
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
goharbor/harbor-registryctl:v2.9.0cce272836449
github.com/jackc/pgproto3/v2@v2.3.2
2.3.3

Open the chart page →

7,672
vaultstakaterVerified publisher0.8.41 of 2See more

vault stakater 0.8.4

1 of the 2 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.4dfc3500beb0e
github.com/jackc/pgx@v3.3.0+incompatible
4.18.2

Open the chart page →

5,864
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
ghcr.io/substra/orchestrator-server:1.0.0647e45284a80
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
github.com/jackc/pgx/v5@v5.3.1
2.3.3
4.18.2
5.5.4

Open the chart page →

2,991
telegraf-ds-k3stelegraf-ds-k3s1.0.01 of 1See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
library/telegraf:1.19.0-alpine794079a7f241
github.com/jackc/pgproto3/v2@v2.0.1
github.com/jackc/pgx/v4@v4.6.0
2.3.3
4.18.2

Open the chart page →

3,764
tfy-cloudflaredtruefoundryVerified publisher0.5.01 of 2See more

tfy-cloudflared truefoundry 0.5.0

1 of the 2 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.2
2.3.3
4.18.2

Open the chart page →

2,015
twitter-apptwitter-helm0.1.121 of 8See more

twitter-app twitter-helm 0.1.12

1 of the 8 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
stakkato95/twitter-service-tweets:0.1.18412d8a8cac3
github.com/jackc/pgproto3/v2@v2.3.0
github.com/jackc/pgx/v4@v4.16.0
2.3.3
4.18.2

Open the chart page →

6,132
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
github.com/jackc/pgproto3/v2@v2.0.7
github.com/jackc/pgx@v3.6.0+incompatible
2.3.3
4.18.2

Open the chart page →

13,459
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx@v3.3.0+incompatible
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
4.18.2

Open the chart page →

14,983
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2024-27304.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2

Open the chart page →

2,022

Container images carrying it

125 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/botify-labs/airbyte_exporter:2.3.02105b1f33013
github.com/jackc/pgx/v5@v5.5.2
5.5.4
1
ghcr.io/camptocamp/terraboard:v2.3.0df53e2c8998c
github.com/jackc/pgx/v5@v5.4.3
5.5.4
1
ghcr.io/cloudnative-pg/cloudnative-pg:1.17.14dd365800b62
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.1
2.3.3
4.18.2
1
ghcr.io/cloudnative-pg/cloudnative-pg:1.21.19f707d91de1c
github.com/jackc/pgx/v5@v5.4.3
5.5.4
1
ghcr.io/cncf/clowarden/dbmigrator:v0.2.3c022fd42de45
github.com/jackc/pgproto3/v2@v2.0.2
github.com/jackc/pgx/v4@v4.7.1
2.3.3
4.18.2
1
ghcr.io/cncf/gitvote/dbmigrator:v1.5.0f1e7efe440da
github.com/jackc/pgproto3/v2@v2.0.2
github.com/jackc/pgx/v4@v4.7.1
2.3.3
4.18.2
1
ghcr.io/formancehq/ledger:v1.9.203c1ddbda33b
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.2
2.3.3
4.18.2
1
ghcr.io/gabe565/limo:latest6dfdbc9853bb
github.com/jackc/pgx/v5@v5.3.0
5.5.4
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.0
2.3.3
4.18.2
1
ghcr.io/netsoc/iamd:1.1.22fe6b69b20d7
github.com/jackc/pgproto3/v2@v2.0.6
github.com/jackc/pgx/v4@v4.10.1
2.3.3
4.18.2
1
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.2
2.3.3
4.18.2
1
ghcr.io/openfaasltd/postgres-connector:0.2.3379e583a0a75
github.com/jackc/pgx@v3.6.2+incompatible
4.18.2
1
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
github.com/jackc/pgproto3/v2@v2.2.0
github.com/jackc/pgx/v4@v4.15.0
2.3.3
4.18.2
1
ghcr.io/sergelogvinov/postgresql:16.15fafb72e98f22
github.com/jackc/pgproto3/v2@v2.0.2
github.com/jackc/pgx/v4@v4.8.1
2.3.3
4.18.2
1
ghcr.io/substra/orchestrator-server:1.0.0647e45284a80
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
github.com/jackc/pgx/v5@v5.3.1
2.3.3
4.18.2
5.5.4
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.2
2.3.3
4.18.2
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
github.com/jackc/pgproto3/v2@v2.3.1
github.com/jackc/pgx/v4@v4.17.2
2.3.3
4.18.2
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/jackc/pgproto3/v2@v2.2.0
github.com/jackc/pgx/v4@v4.14.0
2.3.3
4.18.2
1
quay.io/argoproj/argocli:v3.5.591b9825f09a8
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
1
quay.io/argoproj/workflow-controller:v3.5.56ab0da144235
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
1
quay.io/bentoml/yatai:0.4.614b482c1f1b8
github.com/jackc/pgproto3/v2@v2.1.1
github.com/jackc/pgx/v4@v4.13.0
2.3.3
4.18.2
1
quay.io/bentoml/yatai:1.1.13a5dc9d91de0d
github.com/jackc/pgproto3/v2@v2.1.1
github.com/jackc/pgx/v4@v4.13.0
2.3.3
4.18.2
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx@v3.3.0+incompatible
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
4.18.2
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.1
2.3.3
4.18.2
1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/jackc/pgproto3/v2@v2.3.2
github.com/jackc/pgx/v4@v4.18.0
2.3.3
4.18.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.