{"id":"CVE-2026-120152","kind":"vulnerability","aliases":["CVE-2026-120152"],"related":[],"title":"PostgreSQL: a database user can read memory via settings function","description":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected.","summary":"A use-after-free bug in PostgreSQL's pg_show_all_settings() function can be triggered while a module is loaded, letting a database user retrieve memory contents. The flaw affects PostgreSQL 16 through 18 before the fixed minor releases.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime"],"not_affected_if":["fully-patched-minor-version","postgresql-before-16","trusted-users-only"],"how_to_check":"- Run `SELECT version();` in psql and compare the minor version against the fixed releases.\n- Check whether the server is PostgreSQL 16, 17 or 18 (versions before 16 are unaffected).","fix":"- PostgreSQL `18.7`, `17.12` and `16.16` (the fixed minor versions, per the sources).","status":"open","published_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:58+00:00","updated_at":"2026-11-12T15:43:58+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:58Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`, `17.12` and `16.16` (the fixed minor versions, per the sources).","reach":"network","title":"PostgreSQL: a database user can read memory via settings function","impact":"medium","summary":"A use-after-free bug in PostgreSQL's pg_show_all_settings() function can be triggered while a module is loaded, letting a database user retrieve memory contents. The flaw affects PostgreSQL 16 through 18 before the fixed minor releases.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"database user reads server process memory contents","analyst_note":"Sources state the affected and fixed ranges; exploit conditions beyond module loading are not detailed.","how_to_check":"- Run `SELECT version();` in psql and compare the minor version against the fixed releases.\n- Check whether the server is PostgreSQL 16, 17 or 18 (versions before 16 are unaffected).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["postgresql-before-16","fully-patched-minor-version","trusted-users-only"],"who_is_affected":"Any PostgreSQL server on major version 16, 17 or 18 running a minor version before 18.7, 17.12 or 16.16 is affected. The attacker needs a database login, and the issue is triggered while a module is loaded, so servers with no database users beyond trusted admins carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4589,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120152':13A,16A '-18':101C '-2026':12A,15A '16':53B,100C,115C '16.16':109C '17.12':107C '18':55B '18.7':106C 'affect':51B,111C 'allow':70C 'bug':25B 'content':48B,77C 'custom':88C 'custom-vari':87C 'cve':11A,14A 'databas':3A,17B,44B,72C 'fix':58B 'flaw':50B 'free':24B,63C,96C 'function':10A,33B,84C 'let':42B 'load':41B,79C 'major':98C 'memori':7A,47B,76C 'minor':59B,102C 'modul':39B,81C,93C 'pg':29B,66C 'placehold':90C 'postgresql':1A,18B,27B,52B,65C,105C,114C 'read':6A 'releas':60B 'replac':94C 'retriev':46B,75C 'runtim':19B 'scan':86C 'set':9A,32B,69C 'show':30B,67C 'trigger':36B 'unaffect':117C 'use':22B,61C 'use-after-fre':21B 'user':4A,45B,73C 'variabl':89C 'version':99C,103C,112C 'via':8A,78C 'within':97C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server on major version 16, 17 or 18 running a minor version before 18.7, 17.12 or 16.16 is affected. The attacker needs a database login, and the issue is triggered while a module is loaded, so servers with no database users beyond trusted admins carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","postgresql","runtime"],"campaign_type":null,"search_a":"'-120152':13A,16A '-2026':12A,15A 'cve':11A,14A 'databas':3A 'function':10A 'memori':7A 'postgresql':1A 'read':6A 'set':9A 'user':4A 'via':8A","search_b":"'16':53B '18':55B 'affect':51B 'bug':25B 'content':48B 'databas':17B,44B 'fix':58B 'flaw':50B 'free':24B 'function':33B 'let':42B 'load':41B 'memori':47B 'minor':59B 'modul':39B 'pg':29B 'postgresql':18B,27B,52B 'releas':60B 'retriev':46B 'runtim':19B 'set':32B 'show':30B 'trigger':36B 'use':22B 'use-after-fre':21B 'user':45B","search_c":"'-18':101C '16':100C,115C '16.16':109C '17.12':107C '18.7':106C 'affect':111C 'allow':70C 'content':77C 'custom':88C 'custom-vari':87C 'databas':72C 'free':63C,96C 'function':84C 'load':79C 'major':98C 'memori':76C 'minor':102C 'modul':81C,93C 'pg':66C 'placehold':90C 'postgresql':65C,105C,114C 'replac':94C 'retriev':75C 'scan':86C 'set':69C 'show':67C 'unaffect':117C 'use':61C 'user':73C 'variabl':89C 'version':99C,103C,112C 'via':78C 'within':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120152","severity":null,"published_at":"2026-11-12T15:17:43+00:00","modified_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}