AZL-113690: CVE-2026-116308 affecting package postgresql 16.15-1

Q: Who can exploit this issue?

An attacker needs to be a database user. The issue can disclose portions of PostgreSQL server memory through a zero-length token handled by dict_int.

Q: Is version 16.15-1 affected, and what version fixes it?

Yes. PostgreSQL versions before 16.16 are affected, so postgresql 16.15-1 is within the affected range. Upgrading to PostgreSQL 16.16 or later addresses the issue.

Published Nov 12, 2026

Updated

Buffer over-read in PostgreSQL dictint allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116308

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be a database user. The issue can disclose portions of PostgreSQL server memory through a zero-length token handled by dict_int.

Is version 16.15-1 affected, and what version fixes it?