{"id":"CVE-2026-116333","kind":"vulnerability","aliases":["CVE-2026-116333"],"related":[],"title":"PostgreSQL: parallel B-tree scans let an object creator read server memory","description":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected.","summary":"A buffer over-read in PostgreSQL's parallel B-tree index scans lets a user who can create database objects read chosen server memory addresses. It is triggered by a function wrongly marked PARALLEL SAFE or STABLE, which makes parallel workers build different scan-key arrays.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting-patched","no-untrusted-object-creators","versions-before-17"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether any function is marked PARALLEL SAFE or STABLE in a way that is wrong for its behaviour, for example with `SELECT proname, proparallel, provolatile FROM pg_proc;`.","fix":"- PostgreSQL 18: move to `18.7` or later.\n- PostgreSQL 17: move to `17.12` or later.","status":"open","published_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:52+00:00","updated_at":"2026-11-12T15:43:52+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:52Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: move to `18.7` or later.\n- PostgreSQL 17: move to `17.12` or later.","reach":"network","title":"PostgreSQL: parallel B-tree scans let an object creator read server memory","impact":"medium","summary":"A buffer over-read in PostgreSQL's parallel B-tree index scans lets a user who can create database objects read chosen server memory addresses. It is triggered by a function wrongly marked PARALLEL SAFE or STABLE, which makes parallel workers build different scan-key arrays.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads chosen server memory; possible data leak","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether any function is marked PARALLEL SAFE or STABLE in a way that is wrong for its behaviour, for example with `SELECT proname, proparallel, provolatile FROM pg_proc;`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["versions-before-17","no-untrusted-object-creators","managed-hosting-patched"],"who_is_affected":"Only PostgreSQL servers on major versions 17 and 18 before 18.7 and 17.12 are affected. Exploitation needs an account allowed to create database objects, and a function marked with the wrong parallel safety or volatility setting. Versions before 17 are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4607,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116333':16A,19A '-18':122C '-2026':15A,18A '17':121C,135C '17.12':129C '18.7':127C 'address':52B,98C 'affect':131C 'allow':86C 'array':74B,117C 'attack':93C 'attacker-chosen':92C 'b':4A,36B,83C 'b-tree':3A,35B,82C 'buffer':27B,75C 'build':69B,112C 'chosen':49B,94C 'creat':45B 'creator':10A,89C 'cve':14A,17A 'databas':20B,46B 'differ':70B,113C 'function':58B,101C 'host':25B 'incorrect':102C 'index':38B 'key':73B,116C 'let':7A,40B 'major':119C 'make':66B,109C 'mark':60B,103C 'memori':13A,51B,97C 'minor':123C 'object':9A,47B,88C 'over-read':28B,76C 'parallel':2A,34B,61B,67B,81C,104C 'particip':110C 'postgresql':1A,21B,32B,80C,126C,134C 'read':11A,30B,48B,78C,91C 'runtim':22B 'safe':62B,105C 'scan':6A,39B,72B,85C,115C 'scan-key':71B,114C 'self':24B 'self-host':23B 'server':12A,50B,96C 'server-memori':95C 'stabl':64B,107C 'tree':5A,37B,84C 'trigger':55B 'unaffect':137C 'user':42B 'version':120C,124C,132C 'via':99C 'within':118C 'worker':68B,111C 'wrong':59B","nicknames":[],"mitigations":[],"who_affected":"Only PostgreSQL servers on major versions 17 and 18 before 18.7 and 17.12 are affected. Exploitation needs an account allowed to create database objects, and a function marked with the wrong parallel safety or volatility setting. Versions before 17 are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116333':16A,19A '-2026':15A,18A 'b':4A 'b-tree':3A 'creator':10A 'cve':14A,17A 'let':7A 'memori':13A 'object':9A 'parallel':2A 'postgresql':1A 'read':11A 'scan':6A 'server':12A 'tree':5A","search_b":"'address':52B 'array':74B 'b':36B 'b-tree':35B 'buffer':27B 'build':69B 'chosen':49B 'creat':45B 'databas':20B,46B 'differ':70B 'function':58B 'host':25B 'index':38B 'key':73B 'let':40B 'make':66B 'mark':60B 'memori':51B 'object':47B 'over-read':28B 'parallel':34B,61B,67B 'postgresql':21B,32B 'read':30B,48B 'runtim':22B 'safe':62B 'scan':39B,72B 'scan-key':71B 'self':24B 'self-host':23B 'server':50B 'stabl':64B 'tree':37B 'trigger':55B 'user':42B 'worker':68B 'wrong':59B","search_c":"'-18':122C '17':121C,135C '17.12':129C '18.7':127C 'address':98C 'affect':131C 'allow':86C 'array':117C 'attack':93C 'attacker-chosen':92C 'b':83C 'b-tree':82C 'buffer':75C 'build':112C 'chosen':94C 'creator':89C 'differ':113C 'function':101C 'incorrect':102C 'key':116C 'major':119C 'make':109C 'mark':103C 'memori':97C 'minor':123C 'object':88C 'over-read':76C 'parallel':81C,104C 'particip':110C 'postgresql':80C,126C,134C 'read':78C,91C 'safe':105C 'scan':85C,115C 'scan-key':114C 'server':96C 'server-memori':95C 'stabl':107C 'tree':84C 'unaffect':137C 'version':120C,124C,132C 'via':99C 'within':118C 'worker':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116333","severity":null,"published_at":"2026-11-12T15:17:41+00:00","modified_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}