CVE-2026-120152 · Runtime
NO FIX YET · SEE WHAT TO DO
A use-after-free bug in PostgreSQL's pg_show_all_settings() function can be triggered while a module is loaded, letting a database user retrieve memory contents. The flaw affects PostgreSQL 16 through 18 before the fixed minor releases.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server on major version 16, 17 or 18 running a minor version before 18.7, 17.12 or 16.16 is affected. The attacker needs a database login, and the issue is triggered while a module is loaded, so servers with no database users beyond trusted admins carry less risk.
Not affected if fully-patched-minor-version, postgresql-before-16, trusted-users-only
Who cares database, postgresql
SELECT version(); in psql and compare the minor version against the fixed releases.18.7, 17.12 and 16.16 (the fixed minor versions, per the sources).Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.