CVE-2026-116315
Description
A flaw was found in PostgreSQL. This vulnerability allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database service. By supplying specifically structured text search vector (tsvector) data to the tsvector_delete() function, an attacker triggers a heap-based buffer overflow due to improper handling of alignment padding.
Statement
Red Hat has rated this vulnerability as having an Important severity because an authenticated user can trigger a heap buffer overflow to execute arbitrary code with the permissions of the postgres service account, potentially compromising the host. While the impact on system integrity, confidentiality, and availability is high, exploitation requires valid database credentials and access to execute SQL functions, which prevents unauthenticated remote execution. In standard Red Hat Enterprise Linux deployments, exposure is further constrained by default SELinux policies that confine the PostgreSQL daemon and restrict access to broader system resources.
Mitigation
Restrict network access to PostgreSQL to trusted hosts and clients only, limiting exposure to untrusted database users.
1. Restrict external network reachability to the PostgreSQL service using firewalld:
# firewall-cmd --permanent --remove-service=postgresql
# firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>
# firewall-cmd --reload
2. Configure /var/lib/pgsql/data/pg_hba.conf to only permit connections from authorized client addresses and trusted database roles, then reload the configuration:
# systemctl reload postgresql
Warning: Reloading firewall rules or the PostgreSQL service may temporarily interrupt active network connections. These operational controls reduce exposure by limiting network access to trusted clients, but they do not eliminate risk from authenticated users permitted to execute SQL queries.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
