CVE-2026-33816 is a memory-safety vulnerability in the Go PostgreSQL driver (github.com/jackc/pgx) affecting Red Hat Hardened Images RPMs. The flaw involves out-of-bounds write (CWE-787) and potentially improper validation (CWE-697), which could allow an attacker to cause memory corruption. This corruption may result in denial of service or arbitrary code execution depending on exploitation specifics. Red Hat's CVSS v3.1 score is 8.3 (high), reflecting network attack vector, low complexity, low privileges required, no user interaction, and high confidentiality and integrity impact with low availability impact. Red Hat currently has no mitigation or fix that meets their deployment and stability standards. The advisory references Bugzilla 2455972 and multiple external vulnerability databases.

The vulnerability can lead to memory corruption in the affected PostgreSQL driver, potentially causing denial of service (crashes) or arbitrary code execution. Confidentiality and integrity impacts are high, while availability impact is low according to Red Hat's assessment. Exploitation requires network access and low privileges, with no user interaction needed. No known exploits are reported in the wild at this time.

Red Hat currently does not provide a mitigation that meets their criteria for ease of use, applicability, or stability. No official fix or patch is confirmed available yet. Users are advised to monitor Red Hat advisories for updates. If possible, upgrading to a fixed version when released is recommended. Customers with Red Hat Technical Account Managers (TAM) can consult them for tailored guidance. No specific workaround is provided in the advisory.