CVE-2026-116310 · Runtime
NO FIX YET · SEE WHAT TO DO
A use-after-free in PostgreSQL's COPY FROM error reporting lets a database user read portions of server memory when a longer input row follows an ignored or nullified conversion error. file_fdw reaches the same code path in version 18.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server on major version 17 or 18 before 18.7 or 17.12 is affected, and the flaw needs a database user who can run COPY FROM. Servers on PostgreSQL 16 or earlier are not affected according to the description. Servers that only allow trusted, administrator-level database access have less exposure.
Not affected if patched-minor-version, postgresql-16-or-earlier
Who cares database, postgresql, self-hosted
SELECT version(); in psql and check whether the server is PostgreSQL 17 or 18 below the fixed minor versions.18.7 or later.17.12 or later.Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.