CVE-2026-116333 · Runtime
NO FIX YET · SEE WHAT TO DO
A buffer over-read in PostgreSQL's parallel B-tree index scans lets a user who can create database objects read chosen server memory addresses. It is triggered by a function wrongly marked PARALLEL SAFE or STABLE, which makes parallel workers build different scan-key arrays.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only PostgreSQL servers on major versions 17 and 18 before 18.7 and 17.12 are affected. Exploitation needs an account allowed to create database objects, and a function marked with the wrong parallel safety or volatility setting. Versions before 17 are not affected.
Not affected if managed-hosting-patched, no-untrusted-object-creators, versions-before-17
Who cares database, postgresql, self-hosted
SELECT version(); in psql and compare against the fixed versions below.SELECT proname, proparallel, provolatile FROM pg_proc;.18.7 or later.17.12 or later.Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.