CVE-2026-116317 · Runtime
NO FIX YET · SEE WHAT TO DO
A heap-based buffer overflow in PostgreSQL's ts_rank_cd() function can be triggered by an invalid tsvector containing duplicate positions. A database user who can run queries may execute arbitrary code as the operating system user that runs the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server running a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker needs a database login, so exposure depends on who can run SQL on the server, including through application users with broad query rights. Servers where only trusted roles can connect are lower risk, but the fixed versions still close the flaw.
Not affected if no-untrusted-db-users, patched-version
Who cares database, postgresql, self-hosted
SELECT version(); and compare it to the fixed versions below.18.717.1216.1615.2014.25Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.