The vulnerability resides in the pgproto3 Go library, which parses PostgreSQL wire protocol messages. A malicious or compromised PostgreSQL server can send a DataRow message that specifies a negative field length. This improper input validation causes a slice bounds out of range panic in the client, resulting in a denial‑of‑service (DoS) condition. The weakness is identified as CWE‑129, an input validation failure that triggers uncontrolled memory or control flow errors.

The flaw affects a wide range of Red Hat products that incorporate the pgproto3 library: Assisted Installer for Red Hat OpenShift Container Platform 2, Multicluster Engine for Kubernetes, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat Enterprise Linux 8/9/10, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Cluster Manager CLI, Red Hat OpenShift Container Platform 4, Red Hat OpenShift on AWS, Red Hat Quay 3, and Red Hat Trusted Artifact Signer. Specific affected versions are not listed in the CNA data, so the entire product families are considered potentially impacted.

The CVSS score is 7.5 (High). EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires a compromised or malicious PostgreSQL server that can communicate with the vulnerable client. The attack vector is therefore a remote network attacker or a malicious server; no local privileges are required. Given the severity and the potential for network‑based exploitation, the overall risk level is high, and remediation is advised even if a patch is not currently released.