CVE-2026-33815 is a memory-safety vulnerability classified under CWE-129 (Improper Validation of Array Index) and CWE-787 (Out-of-bounds Write) found in github.com/jackc/pgx/v5, specifically in the pgproto3 package. The flaw allows out-of-range write operations that can corrupt memory, modify control data such as return addresses, and lead to execution of unexpected code or system crashes. The vulnerability has a CVSS 3.1 base score of 9.8 (critical) with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. It affects versions of Red Hat Trusted Artifact Signer up to but not including 1.3.5. Red Hat has not yet provided a patch that meets their criteria for deployment and stability. The vulnerability is under active investigation and remediation planning by Red Hat Product Security.

The vulnerability can lead to memory corruption causing unexpected behavior or system instability, including potential unauthorized code execution and denial of service conditions. The CVSS score of 9.8 indicates critical severity with high confidentiality, integrity, and availability impacts. No known exploits are currently reported in the wild. The affected product is Red Hat Trusted Artifact Signer versions prior to 1.3.5.

Currently, no official fix or mitigation meeting Red Hat's criteria for ease of use, deployment, applicability, and stability is available. Users should monitor Red Hat advisories for updates and consider upgrading to Red Hat Trusted Artifact Signer version 1.3.5 or later once released. Customers with Red Hat Technical Account Managers can seek direct guidance. No other mitigations are recommended at this time.