GHSA-6ggm-xmc9-8ffg

Facts

Severity

High · CVSS score 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions (libpg_query)

< 17-6.2.4, < 18.1.0As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it

Fixed in (libpg_query)

17-6.2.4, 18.1.0

Package name (pg_query_go)

pg_query_goAs entered. Doesn’t look like a valid Go package name, so scanners can’t match it. How to fix it

Affected versions (pg_query_go)

< 6.2.5As entered by the maintainer. Not reviewed.

Fixed in (pg_query_go)

6.2.5

Affected versions (pg_query)

< 6.2.5As entered by the maintainer. Not reviewed.

Fixed in (pg_query)

6.2.5

Affected versions (pg_query)

< 6.2.1As entered by the maintainer. Not reviewed.

Fixed in (pg_query)

6.2.1

CVE

None cited by the advisory

GitHub Advisory Database

Not reviewed

OSV.dev

Not present

Other CVEs pointing here

None found in the CVE List

Timeline

1. 2026-09-30 17:37 UTC

   Published by the maintainers

   No CVE cited

2. 2026-11-11 11:55 UTC

   First seen by Limbowatch

   not reviewed · not in OSV

3. Waiting

   Reviewed by GitHub

4. Waiting

   In OSV; scanners can see it

Machine-readable record: feed/GHSA-6ggm-xmc9-8ffg.json