CVE-2026-116315 · Runtime
NO FIX YET · SEE WHAT TO DO
A heap-based buffer overflow in PostgreSQL's tsvector_delete() function can be triggered by a crafted tsvector value with a nonstandard but valid lexeme ordering. A database user with ordinary access can use it to execute arbitrary code as the operating system user running the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server on a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker needs a normal database login, so exposure depends on who holds database accounts and whether untrusted users can run queries that call tsvector functions. unknown whether managed hosting providers have already patched.
Not affected if managed-hosting-patched, no-untrusted-db-users
Who cares database, postgresql, self-hosted
SELECT version(); in psql and compare against the fixed versions listed below.postgres --version.18.717.1216.1615.2014.25Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.