CVE-2026-120139 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL miscalculates in-memory tuple sizes because of an integer wraparound when handling oversized tuple data. A database user can use this to execute arbitrary code as the operating system user running the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server earlier than the fixed versions listed is affected. The attacker needs a database login, so exposure depends on who can connect and run queries. Servers where only trusted application roles can log in carry lower risk, but the flaw still matters for shared or multi-tenant databases.
Not affected if managed-hosting-patched, patched-version
Who cares database, postgresql, self-hosted
psql -c "SHOW server_version;" and compare against the fixed versions below.18.717.1216.1615.2014.25Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.