{
  "threat_severity" : "Important",
  "public_date" : "2026-11-12T14:15:17Z",
  "bugzilla" : {
    "description" : "postgresql: postgresql: Arbitrary code execution via aggregate optimization type confusion",
    "id" : "2572566",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2572566"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-843",
  "details" : [ "A flaw was found in PostgreSQL. An authenticated user with permission to create database objects can exploit this vulnerability to achieve arbitrary code execution as the operating system user running the database service. The issue occurs during query optimization when a user-defined aggregate function specifies a sort operator (SORTOP) that causes the query planner to treat different data types as identical. This data type confusion allows an attacker to manipulate internal memory and compromise the host system." ],
  "statement" : "This vulnerability is rated as having an Important severity for Red Hat deployments because, although successful exploitation leads to complete arbitrary code execution under the operating system account running the database service, it requires an authenticated attacker with permissions to define custom database objects rather than being exploitable by unauthenticated remote users. In typical enterprise environments, database access is restricted and standard application roles do not possess schema creation privileges, which limits the attack surface to trusted or privileged database accounts. However, in shared hosting or multi-tenant configurations where non-administrative users can create schemas and custom routines, an attacker could leverage this flaw to fully compromise the database host.",
  "package_state" : [ {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "libpq",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "postgresql17",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "postgresql18",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-116331\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116331\nhttps://www.postgresql.org/support/security/CVE-2026-116331/" ],
  "name" : "CVE-2026-116331",
  "mitigation" : {
    "value" : "Revoke object creation permissions from untrusted database accounts and restrict network access to trusted administrative hosts.\n1. Revoke schema creation permissions to prevent users from defining custom aggregates:\n```sql\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\nREVOKE CREATE ON SCHEMA <schema_name> FROM <username>;\n```\n2. Limit network access to trusted clients using firewalld:\n```bash\nfirewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>\nfirewall-cmd --permanent --zone=public --remove-service=postgresql\nfirewall-cmd --reload\n```\nAlternatively, restrict client access rules in `/var/lib/pgsql/data/pg_hba.conf` and apply the configuration:\n```bash\nsystemctl reload postgresql\n```\nCaveats: Revoking object creation privileges prevents non-administrative users and applications from creating or modifying custom database objects and schemas. Limiting network access will block queries from unlisted client hosts.\nWarning: Modifying firewall rules or reloading the PostgreSQL service (`systemctl reload postgresql`) affects service accessibility. Ensure configuration changes are applied during scheduled maintenance windows to prevent unexpected disruption to active sessions.",
    "lang" : "en:us"
  },
  "csaw" : false
}