The DataRow.Decode function in the Go package github.com/jackc/pgproto3/v2 does not properly validate field lengths. An attacker who can influence the PostgreSQL server to send a DataRow message with a negative field length can trigger a slice bounds out of range panic, causing the client process to crash. This disruption results in a denial of service for any application relying on this library.

The vulnerability affects the golang library github.com/jackc/pgproto3/v2. Any Go application that imports this package, especially those using the pgx PostgreSQL driver, may be impacted if the application connects to a PostgreSQL instance that can send malformed DataRow messages. No specific version ranges are provided in the advisory.

Exploitation requires the attacker to control or compromise a PostgreSQL server that can send a malicious DataRow message. The advisory does not provide an EPSS score or CVSS score, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector involves a database server, the risk is moderate to high for systems that accept connections from untrusted or potentially malicious database instances. The impact is a definitive crash of the client process, leading to service interruption.