Live › vulnerability › CVE-2026-96883
Go to dashboardpgcollection is an open source PostgreSQL extension from AWS. Requesting a stored collection value as an incompatible type makes the extension misread its data, so an authenticated database user can crash the PostgreSQL backend or execute arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC, 0h before NVD. All times on this page are UTC.
Self-managed PostgreSQL deployments that downloaded and compiled pgcollection versions through from the AWS GitHub repository are affected. Amazon RDS for PostgreSQL and Aurora PostgreSQL customers are not affected, since those services ship .
2.0.02.1.11.1.1No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'pgcollection';2.1.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution
Bulletin ID: 2026-118-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 12:00 PM PDT
Description:
pgcollection is an open source extension to PostgreSQL. We identified CVE-2026-96883, an issue in pgcollection's type coercion logic. When requesting a stored icollection value as a type incompatible with how it was actually stored causes the extension to misinterprets the datum's representation, allowing an authenticated database user to crash the PostgreSQL backend or execute arbitrary code.
Impacted versions: pgcollection v2.0.0 through v2.1.1
Resolution:
This issue has been addressed in pgcollection version 2.1.2. This issue does not impact existing Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL customers. These services only ship 1.1.1 version, which does not contain this issue.
Customers who downloaded and compiled pgcollection 2.0.0 through 2.1.1 from the AWS GitHub repository and deployed them in their own PostgreSQL environments should upgrade to version 2.1.2 or later.
Workarounds:
None.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-96883")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.