Who is not affected by CVE-2026-16240?

Q: Who is not affected by CVE-2026-16240?

Not affected if: not-using-pg_basebackup, trusted-source-servers-only.

LOW3.7CVSS · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

NO KNOWN
EXPLOIT

CVE-2026-16240 · Vendor

PostgreSQL: pg_basebackup format string flaw can leak client memory

NO FIX YET · SEE WHAT TO DO

A flaw in PostgreSQL's pg_basebackup tool lets a server that has already been compromised read bytes from pg_basebackup's memory through crafted backup manifest data. The leaked bytes are not sent back to the attacker, so an exploit would need additional implementation-specific knowledge to recover useful secrets.

Full story ↓Less ↑

first public Nov 12, 2026 · 1 source

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

Teams that run pg_basebackup to take backups from PostgreSQL servers, where the source server could be controlled by an attacker. The attacker must already have compromised the server being backed up. Teams that do not use pg_basebackup, or only back up trusted servers, are at lower risk.

Not affected if not-using-pg_basebackup, trusted-source-servers-only

Who cares database-backups, pg_basebackup, postgresql

02 · How to check

Check the installed version with pg_basebackup --version
Versions before 18.7, 17.12, 16.16, 15.20 and 14.25 are affected

03 · The fix

Upgrade PostgreSQL to 18.7, 17.12, 16.16, or for the matching major version

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

What the sources say, verbatim

549 characters

Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.