CVE-2026-33815 is a memory-safety vulnerability classified under CWE-129 (Improper Validation of Array Index) and CWE-787 (Out-of-bounds Write) found in the github.com/jackc/pgx/v5/pgproto3 package. The flaw allows out-of-range write operations that can corrupt memory, potentially modifying control data such as return addresses, leading to execution of unexpected code or system crashes. The vulnerability has a CVSS v3.1 base score of 9.8 (critical) with network attack vector, low complexity, no privileges required, and no user interaction. Red Hat has identified this issue affecting their Trusted Artifact Signer (RHTAS) 1.3.5 release and related OpenShift Container Platform versions. However, no official patch or mitigation currently meets Red Hat's standards for deployment and stability. The advisory references multiple CVEs including CVE-2026-33816 and CVE-2026-34986, indicating related issues.

The vulnerability can lead to memory corruption through out-of-bounds write operations, which may cause system instability, denial of service (crashes or restarts), and potentially unauthorized code execution by modifying control data. Confidentiality, integrity, and availability impacts are rated high to low respectively. There are no known exploits in the wild at this time. The affected products include Red Hat Trusted Artifact Signer and related OpenShift Container Platform versions.

Currently, no official fix or mitigation that meets Red Hat's criteria for ease of use, deployment, applicability, or stability is available. Users should monitor Red Hat security advisories for updates and consider upgrading to supported product versions once fixes are released. Customers with Red Hat Technical Account Managers (TAM) can consult directly for guidance. No workaround or temporary fix is provided in the advisory.