{"id":"CVE-2026-116308","kind":"vulnerability","aliases":["CVE-2026-116308"],"related":[],"title":"PostgreSQL: dict_int buffer over-read leaks server memory to database users","description":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's dict_int text search dictionary reads past a buffer when given a zero-length token. A database user with normal query access can read portions of server memory.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting-patched","no-untrusted-db-users"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed releases.\n- Check whether the `dict_int` extension or dictionary is installed: `SELECT * FROM pg_ts_dict WHERE dict_init::text LIKE '%dict_int%';`","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","triaged_at":"2026-11-12T15:44:05+00:00","updated_at":"2026-11-12T15:44:05+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:44:05Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: dict_int buffer over-read leaks server memory to database users","impact":"low","summary":"PostgreSQL's dict_int text search dictionary reads past a buffer when given a zero-length token. A database user with normal query access can read portions of server memory.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Database user reads fragments of server process memory","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed releases.\n- Check whether the `dict_int` extension or dictionary is installed: `SELECT * FROM pg_ts_dict WHERE dict_init::text LIKE '%dict_int%';`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting-patched","no-untrusted-db-users"],"who_is_affected":"Any PostgreSQL server before the listed fixed releases is affected, since the flaw sits in a bundled text search dictionary. The exposure is limited to users who already have database access, so servers that only accept trusted application connections carry less risk. Teams on managed PostgreSQL should confirm the provider's patched version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4539,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116308':16A,19A '-2026':15A,18A '14.25':89C '15.20':87C '16.16':86C '17.12':85C '18.7':84C 'access':50B 'affect':91C 'allow':65C 'buffer':4A,36B,57C 'cve':14A,17A 'databas':12A,20B,45B,67C 'dict':2A,28B,63C 'dictionari':32B 'disclos':70C 'given':38B 'host':25B 'int':3A,29B,64C 'leak':8A 'length':42B,79C 'memori':10A,56B,74C 'normal':48B 'over-read':5A,58C 'past':34B 'portion':53B,71C 'postgresql':1A,21B,26B,62C,83C 'queri':49B 'read':7A,33B,52B,60C 'runtim':22B 'search':31B 'self':24B 'self-host':23B 'server':9A,55B,73C 'text':30B 'token':43B,80C 'user':13A,46B,68C 'version':81C 'via':75C 'zero':41B,78C 'zero-length':40B,77C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server before the listed fixed releases is affected, since the flaw sits in a bundled text search dictionary. The exposure is limited to users who already have database access, so servers that only accept trusted application connections carry less risk. Teams on managed PostgreSQL should confirm the provider's patched version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116308':16A,19A '-2026':15A,18A 'buffer':4A 'cve':14A,17A 'databas':12A 'dict':2A 'int':3A 'leak':8A 'memori':10A 'over-read':5A 'postgresql':1A 'read':7A 'server':9A 'user':13A","search_b":"'access':50B 'buffer':36B 'databas':20B,45B 'dict':28B 'dictionari':32B 'given':38B 'host':25B 'int':29B 'length':42B 'memori':56B 'normal':48B 'past':34B 'portion':53B 'postgresql':21B,26B 'queri':49B 'read':33B,52B 'runtim':22B 'search':31B 'self':24B 'self-host':23B 'server':55B 'text':30B 'token':43B 'user':46B 'zero':41B 'zero-length':40B","search_c":"'14.25':89C '15.20':87C '16.16':86C '17.12':85C '18.7':84C 'affect':91C 'allow':65C 'buffer':57C 'databas':67C 'dict':63C 'disclos':70C 'int':64C 'length':79C 'memori':74C 'over-read':58C 'portion':71C 'postgresql':62C,83C 'read':60C 'server':73C 'token':80C 'user':68C 'version':81C 'via':75C 'zero':78C 'zero-length':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116308","severity":null,"published_at":"2026-11-12T15:17:38+00:00","modified_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","fetched_at":"2026-11-12T15:41:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}