CVE-2026-66838: postgrex from 0.19.3 (inclusive), before 0.22.4 (exclusive), 0.19.3 to before 0.22.4

Affected technology

postgrex · from 0.19.3 (inclusive), before 0.22.4 (exclusive)
elixir-ecto

postgrex · 0.19.3 to before 0.22.4
elixir-ecto

postgrex · 4971a2722fa72f8e1b54a2c403cad4c43916e36d to before *; status changes: e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c — unaffected, 4011be852c99dc61ddb98cb01aa41e8775a0e3dd — unaffected
elixir-ecto

Component: 'Elixir.Postgrex', 'Elixir.Postgrex.Protocol'
Function: 'Elixir.Postgrex':stream/4, 'Elixir.Postgrex.Protocol':parse_describe_comment_msgs/3
File: lib/postgrex.ex, lib/postgrex/protocol.ex

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.9/10) rates confidentiality impact as high; integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.