CVE-2026-116317
Description
A flaw was found in PostgreSQL. A heap-based buffer overflow in the text search ranking function, ts_rank_cd(), allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database service. By supplying a malformed text search vector (tsvector) containing duplicate positions, an attacker can trigger memory corruption, resulting in arbitrary code execution or a denial of service (DoS).
Statement
This vulnerability is rated as an Important severity rather than Critical because exploitation requires an attacker to be authenticated as a database user with rights to execute queries against the PostgreSQL instance. While default Red Hat Enterprise Linux deployments enforce authentication boundaries and utilize local peer authentication or network restrictions, an authenticated user can leverage a malformed tsvector to execute code within the context of the unprivileged postgres system account. The blast radius is limited by process isolation and SELinux confinement, preventing immediate direct administrative host takeover.
Mitigation
Restrict network access to the PostgreSQL service to trusted hosts and revoke execute permissions on the vulnerable ranking functions from untrusted database users:
1. Limit incoming network connections to trusted management hosts using firewalld:
# firewall-cmd --permanent --remove-service=postgresql
# firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_network>
# firewall-cmd --reload
2. Revoke execute permissions on ts_rank_cd functions from the PUBLIC role in affected databases:
REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(tsvector, tsquery) FROM PUBLIC;
REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(tsvector, tsquery, integer) FROM PUBLIC;
REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(float4[], tsvector, tsquery) FROM PUBLIC;
REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(float4[], tsvector, tsquery, integer) FROM PUBLIC;
Caveats:
Revoking permissions on ts_rank_cd causes applications utilizing text search ranking via Cover Density to fail with permission denied errors. Applying firewall restrictions blocks external connections not originating from explicitly authorized sources.
Warning:
Reloading firewall configurations via firewall-cmd may interrupt active client network connections. If modifying pg_hba.conf to enforce access restrictions, reloading the database service (systemctl reload postgresql) is required and may temporarily affect client connections.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
