{"id":"CVE-2026-96883","kind":"vulnerability","aliases":["CVE-2026-96883"],"related":[],"title":"pgcollection: type confusion lets an authenticated database user run code","description":"CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution\n\n### CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution\n\nBulletin ID: 2026-118-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 12:00 PM PDT\n\nDescription:\n\npgcollection is an open source extension to PostgreSQL. We identified CVE-2026-96883, an issue in pgcollection's type coercion logic. When requesting a stored icollection value as a type incompatible with how it was actually stored causes the extension to misinterprets the datum's representation, allowing an authenticated database user to crash the PostgreSQL backend or execute arbitrary code.\n\nImpacted versions: pgcollection v2.0.0 through v2.1.1\n\nResolution:\n\nThis issue has been addressed in pgcollection version 2.1.2. This issue does not impact existing Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL customers. These services only ship 1.1.1 version, which does not contain this issue.\n\nCustomers who downloaded and compiled pgcollection 2.0.0 through 2.1.1 from the AWS GitHub repository and deployed them in their own PostgreSQL environments should upgrade to version 2.1.2 or later.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-96883 \n- GHSA-g539-cj32-hv6r\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"pgcollection is an open source PostgreSQL extension from AWS. Requesting a stored collection value as an incompatible type makes the extension misread its data, so an authenticated database user can crash the PostgreSQL backend or execute arbitrary code.","severity":"high","cvss":8.8,"epss":0.0065,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","lab-disclosure","package","pgcollection","postgresql","self-hosted"],"not_affected_if":["managed-hosting","rds-or-aurora"],"how_to_check":"- Check the installed pgcollection version in each PostgreSQL database with `SELECT extversion FROM pg_extension WHERE extname = 'pgcollection';`\n- Confirm whether the extension was compiled from the AWS GitHub repository rather than taken from Amazon RDS or Aurora, which the bulletin says ship 1.1.1","fix":"- Upgrade self-compiled pgcollection to `2.1.2` or later\n- Workarounds: unknown (the bulletin states none)","status":"open","published_at":"2026-09-24T00:00:00+00:00","first_seen_at":"2026-10-24T20:05:35+00:00","triaged_at":"2026-10-25T05:29:27+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:29:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade self-compiled pgcollection to `2.1.2` or later\n- Workarounds: unknown (the bulletin states none)","reach":"network","title":"pgcollection: type confusion lets an authenticated database user run code","impact":"high","summary":"pgcollection is an open source PostgreSQL extension from AWS. Requesting a stored collection value as an incompatible type makes the extension misread its data, so an authenticated database user can crash the PostgreSQL backend or execute arbitrary code.","category":"package","nicknames":[],"who_cares":["postgresql","self-hosted","pgcollection"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated database user runs arbitrary code on the PostgreSQL server","analyst_note":"","how_to_check":"- Check the installed pgcollection version in each PostgreSQL database with `SELECT extversion FROM pg_extension WHERE extname = 'pgcollection';`\n- Confirm whether the extension was compiled from the AWS GitHub repository rather than taken from Amazon RDS or Aurora, which the bulletin says ship 1.1.1","needs_analyst":false,"not_affected_if":["managed-hosting","rds-or-aurora"],"who_is_affected":"Self-managed PostgreSQL deployments that downloaded and compiled pgcollection versions `2.0.0` through `2.1.1` from the AWS GitHub repository are affected. Amazon RDS for PostgreSQL and Aurora PostgreSQL customers are not affected, since those services ship `1.1.1`.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3809,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118':92C '-2026':12A,15A,66C,78C,120C,245C '-96883':13A,16A,67C,79C,121C,246C '00':105C '09/24/2026':103C '1.1.1':204C '12':104C '2.0.0':218C '2.1.1':220C '2.1.2':184C,238C '2026':91C 'actual':144C 'address':180C 'allow':73C,85C,155C 'amazon':191C,196C 'arbitrari':63B,167C 'attent':100C 'aurora':197C 'authent':6A,53B,157C 'aw':17B,35B,71C,83C,93C,95C,223C 'aws-security@amazon.com':254C 'backend':60B,164C 'bulletin':89C 'caus':146C 'cj32':250C 'code':10A,64B,75C,87C,168C 'coercion':128C 'collect':39B 'compil':216C 'concern':260C 'confus':3A,69C,81C 'contain':209C 'content':96C 'crash':57B,161C 'custom':199C,212C 'cve':11A,14A,65C,77C,119C,244C 'data':50B 'databas':7A,54B,158C 'date':102C 'datum':152C 'deploy':227C 'descript':108C 'disclosur':20B 'download':214C 'email':253C 'environ':233C 'execut':62B,76C,88C,166C 'exist':190C 'extens':33B,47B,114C,148C 'g539':249C 'ghsa':248C 'ghsa-g539-cj32-hv6r':247C 'github':224C 'host':26B 'hv6r':251C 'icollect':134C 'id':90C 'identifi':118C 'impact':169C,189C 'import':98C 'incompat':43B,139C 'issu':123C,177C,186C,211C 'lab':19B 'lab-disclosur':18B 'later':240C 'let':4A 'logic':129C 'make':45B 'misinterpret':150C 'misread':48B 'none':242C 'open':30B,112C 'packag':21B 'pdt':107C 'pgcollect':1A,22B,27B,72C,84C,109C,125C,171C,182C,217C 'pleas':252C 'pm':106C 'postgresql':23B,32B,59B,116C,163C,194C,198C,232C 'public':101C 'question':258C 'rds':192C 'refer':243C 'remot':74C,86C 'repositori':225C 'represent':154C 'request':36B,131C 'requir':99C 'resolut':175C 'run':9A 'scope':94C 'secur':257C 'self':25B 'self-host':24B 'servic':201C 'ship':203C 'sourc':31B,113C 'store':38B,133C,145C 'type':2A,44B,68C,80C,97C,127C,138C 'upgrad':235C 'user':8A,55B,159C 'v2.0.0':172C 'v2.1.1':174C 'valu':40B,135C 'version':170C,183C,205C,237C 'workaround':241C","nicknames":[],"mitigations":[],"who_affected":"Self-managed PostgreSQL deployments that downloaded and compiled pgcollection versions `2.0.0` through `2.1.1` from the AWS GitHub repository are affected. Amazon RDS for PostgreSQL and Aurora PostgreSQL customers are not affected, since those services ship `1.1.1`.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-24T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-118-aws/#CVE-2026-96883","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-118-aws/","severity":null,"published_at":"2026-09-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T20:05:35+00:00","fetched_at":"2026-10-24T20:05:35+00:00","note":"AWS: CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution"},{"source":"nvd","external_id":"CVE-2026-96883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96883","severity":null,"published_at":"2026-09-24T20:17:35+00:00","modified_at":"2026-09-25T13:16:34+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96883","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96883","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2971,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-118-aws/","title":"AWS: CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution","kind":"advisory","source":"lab","text":"CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution\n\n### CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution\n\nBulletin ID: 2026-118-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 12:00 PM PDT\n\nDescription:\n\npgcollection is an open source extension to PostgreSQL. We identified CVE-2026-96883, an issue in pgcollection's type coercion logic. When requesting a stored icollection value as a type incompatible with how it was actually stored causes the extension to misinterprets the datum's representation, allowing an authenticated database user to crash the PostgreSQL backend or execute arbitrary code.\n\nImpacted versions: pgcollection v2.0.0 through v2.1.1\n\nResolution:\n\nThis issue has been addressed in pgcollection version 2.1.2. This issue does not impact existing Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL customers. These services only ship 1.1.1 version, which does not contain this issue.\n\nCustomers who downloaded and compiled pgcollection 2.0.0 through 2.1.1 from the AWS GitHub repository and deployed them in their own PostgreSQL environments should upgrade to version 2.1.2 or later.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-96883 \n- GHSA-g539-cj32-hv6r\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-24T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}