uptrace pgdriver SQL injection vulnerability

MEDIO 6.5CVE-2024-44906 · GHSA-h4h6-vccr-44h2 · GO-2025-3765 · Published 12/06/2025 · updated 17/06/2026

In breve

CVE-2024-44906 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda github.com/uptrace/bun/driver/pgdriver, pgdriver (uptrace).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.39%, superiore al 33.7% delle vulnerabilità.
Correzione: aggiornare a 1.2.15 o successiva.

Package	Affected versions	Patched versions
github.com/uptrace/bun/driver/pgdriver Go	`< 1.2.15`	`1.2.15`
pgdriver uptrace	`= 1.2.1`	No fix yet

Description

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.

NVD description

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.

References

nvd.nist.gov/vuln/detail/CVE-2024-44906 · ADVISORY
uptrace/bun · WEB
uptrace/bun commit 8067a8f · WEB
uptrace/bun · PACKAGE
uptrace/bun · WEB
uptrace/bun · WEB
uptrace/bun · WEB
media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf · WEB
sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw · WEB
GitHub Advisory GHSA-h4h6-vccr-44h2

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free