CVE-2026-120149 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's postgres_fdw extension mishandles the row count returned by a remote server during batch inserts, causing a heap buffer overflow. A malicious or compromised foreign server can use this to execute arbitrary code on the PostgreSQL instance that connects to it.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 that use the postgres_fdw extension to write to remote tables are exposed. The risk comes from the foreign server that receives the inserts, so deployments that never use postgres_fdw can skip it. unknown whether exploitation requires a specific remote rule configuration beyond normal use.
Not affected if fixed-version, no-postgres-fdw
Who cares database, postgres_fdw, postgresql, self-hosted
psql -c "SHOW server_version;", then compare against the fixed versions below.psql -c "\dx postgres_fdw".18.717.1216.1615.20Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
14.25