Type Confusion Vulnerability in AWS pgcollection for PostgreSQL
CVE-2026-96883

8.7HIGH

Key Information:

Vendor

Aws

Status
Pgcollection
Vendor
CVE Published:
24 September 2026

What is CVE-2026-96883?

pgcollection, an open-source extension designed for PostgreSQL, is affected by a type confusion vulnerability that exists in versions 2.0.0 through 2.1.1. This vulnerability may allow an authenticated remote user to execute arbitrary code with the privileges of the postgres operating system user by sending carefully crafted SQL statements. The issue arises due to mismatched type metadata in functions related to collection value retrieval and array conversion. Users are advised to upgrade to version 2.1.2 or later to mitigate this risk effectively.

Affected Version(s)

pgcollection 2.0.0 <= 2.1.1

References

https://github.com/aws/pgcollection/releases/tag/v2.1.2
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/aws/pgcollection/security/advisories/G...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.