---
id: "GHSA-g539-cj32-hv6r"
kind: "vulnerability"
aliases: ["GHSA-g539-cj32-hv6r"]
title: "CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "lab-disclosure", "package", "pgcollection", "postgresql", "self-hosted"]
not_affected_if: ["managed-hosting", "rds-or-aurora"]
published_at: "2026-09-24T00:00:00+00:00"
first_seen_at: "2026-10-24T20:05:35+00:00"
updated_at: "2026-10-25T05:30:22+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-118-aws/", "first_seen_at": "2026-10-24T20:05:35+00:00"}]
---

# CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution

pgcollection, an open source PostgreSQL extension from AWS, mishandles a stored collection value when it is requested as an incompatible type. An authenticated database user can crash the PostgreSQL backend or execute arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed pgcollection version in each PostgreSQL database with `SELECT extversion FROM pg_extension WHERE extname = 'pgcollection';` and whether it is 2.0.0 through 2.1.1
- Confirm whether the database is self-hosted with pgcollection compiled from the AWS GitHub repository; RDS and Aurora ship 1.1.1 and are not affected

## Fix

- Upgrade self-hosted pgcollection to `2.1.2` or later
- No workaround is published by AWS

## Timeline

- 2026-10-24T20:05:35+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-118-aws/ — AWS: CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution

## Documents

- [advisory] AWS: CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution https://aws.amazon.com/security/security-bulletins/rss/2026-118-aws/

## From the sources

CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution

### CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution

Bulletin ID: 2026-118-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 12:00 PM PDT

Description:

pgcollection is an open source extension to PostgreSQL. We identified CVE-2026-96883, an issue in pgcollection's type coercion logic. When requesting a stored icollection value as a type incompatible with how it was actually stored causes the extension to misinterprets the datum's representation, allowing an authenticated database user to crash the PostgreSQL backend or execute arbitrary code.

Impacted versions: pgcollection v2.0.0 through v2.1.1

Resolution:

This issue has been addressed in pgcollection version 2.1.2. This issue does not impact existing Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL customers. These services only ship 1.1.1 version, which does not contain this issue.

Customers who downloaded and compiled pgcollection 2.0.0 through 2.1.1 from the AWS GitHub repository and deployed them in their own PostgreSQL environments should upgrade to version 2.1.2 or later.

Workarounds:

None.

References:

- CVE-2026-96883 
- GHSA-g539-cj32-hv6r

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_