CVEvulnerability

CVE-2026-2003

4.3 MEDIUM Published 2026-02-12 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-12
Last modified
2026-06-17
Assigner
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS 3.1 (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-1287

Description

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Affected configurations

• postgresql postgresql (>= 14.0 < 14.21) • postgresql postgresql (>= 15.0 < 15.16) • postgresql postgresql (>= 16.0 < 16.12) • postgresql postgresql (>= 17.0 < 17.8) • postgresql postgresql (>= 18.0 < 18.2)

Related

Weakness · CWE (1)

  • CWE-1287 Improper Validation of Specified Type of Input weakness

References