Integer Underflow in PostgreSQL ECPG Affects Database Clients
CVE-2026-16241

3.8LOW

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-16241?

An integer underflow vulnerability in PostgreSQL's ECPG component can be exploited by a database server administrator to cause a denial of service (DoS) to the ECPG client. This occurs when a specially crafted bytea value is sent without the necessary prefix, leading to an overwhelming memory overwrite. While this typically results in a SIGSEGV error, there is potential for client-specific impacts on data integrity in rare situations. Users are advised to upgrade to secure versions to mitigate this risk.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-16241/

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks ylwangtju for reporting this problem.
.