x/vulndb: suggestion regarding GO-2026-4771

[ryancragun]

Report ID

GO-2026-4771

Suggestion/Comment

This appears to be fixed in versions v5.9.0 and v5.9.1:
jackc/pgx#2519
jackc/pgx@6dbad4c

[porqueno-studio]

Confirmed the fix is present in v5.9.1 by reading the tagged source directly:

• pgproto3/bind.go (Bind.Decode): the msgSize < 0 || len(src[rp:]) < msgSize guard from jackc/pgx@6dbad4c is present.
• pgproto3/function_call.go (FunctionCall.Decode): the argumentLength < 0 guard from jackc/pgx@025d48c is present, together with the pre-read bounds check len(src[rp:]) < nArgumentCodes*2+2 from the fuzz-test fix jackc/pgx@9844024519.

All three fix commits are in v5.9.0 and v5.9.1 (verified via git tag --contains).

The root cause of the false positive appears to be the missing versions: block on the module stanza in the report YAML. Per doc/format.md:

If omitted, it is assumed that every version of the module is vulnerable.

Adding

versions:
    - fixed: "5.9.0"

to the module block (alongside the existing vulnerable_at: 5.9.1) would let govulncheck mark v5.9.0+ as fixed and stop raising the false positive for every pgx user.